# Health alerts for Fortinet FortiGate SNMP-monitored devices

# Hardware sensor alarm
 template: fortigate_hw_sensor_alarm
       on: snmp.device_prof_fgHwSensorEntAlarmStatus
    class: Errors
     type: System
component: Hardware
   lookup: average -1m unaligned percentage of ok
    units: %
    every: 10s
     warn: $this < 100
    delay: down 5m multiplier 1.5 max 1h
  summary: FortiGate sensor ${label:sensor_name} alarm
     info: Hardware sensor ${label:sensor_name} on FortiGate device has triggered an alarm
       to: sysadmin

# HA node sync status
 template: fortigate_ha_node_out_of_sync
       on: snmp.device_prof_fgHaStatsSyncStatus
    class: Errors
     type: System
component: HA
   lookup: average -1m unaligned percentage of in_sync
    units: %
    every: 10s
     warn: $this < 100
    delay: down 2m multiplier 1.5 max 1h
  summary: FortiGate HA node ${label:ha_node_hostname} sync
     info: FortiGate HA cluster member ${label:ha_node_hostname} (${label:ha_node_serial}) is out of sync
       to: sysadmin

# HA node CPU usage
 template: fortigate_ha_node_cpu_high
       on: snmp.device_prof_fgHaStatsCpuUsage
    class: Utilization
     type: System
component: HA
   lookup: average -5m unaligned
    units: %
    every: 1m
     warn: $this > 75
     crit: $this > 90
    delay: down 5m multiplier 1.5 max 1h
  summary: FortiGate HA node ${label:ha_node_hostname} CPU
     info: CPU utilization on FortiGate HA cluster member ${label:ha_node_hostname} is high
       to: sysadmin

# HA node memory usage
 template: fortigate_ha_node_memory_high
       on: snmp.device_prof_fgHaStatsMemUsage
    class: Utilization
     type: System
component: HA
   lookup: average -5m unaligned
    units: %
    every: 1m
     warn: $this > 80
     crit: $this > 95
    delay: down 5m multiplier 1.5 max 1h
  summary: FortiGate HA node ${label:ha_node_hostname} memory
     info: Memory utilization on FortiGate HA cluster member ${label:ha_node_hostname} is high
       to: sysadmin

# SD-WAN link dead
 template: fortigate_sdwan_link_dead
       on: snmp.device_prof_fgVWLHealthCheckLinkState
    class: Errors
     type: System
component: Network
   lookup: average -1m unaligned percentage of alive
    units: %
    every: 10s
     crit: $this < 100
    delay: down 1m multiplier 1.5 max 1h
  summary: FortiGate SD-WAN ${label:sdwan_healthcheck} link down
     info: SD-WAN health-check ${label:sdwan_healthcheck} on interface ${label:sdwan_interface} reports link is dead
       to: sysadmin

# SD-WAN link high latency
 template: fortigate_sdwan_link_latency_high
       on: snmp.device_prof_fgVWLHealthCheckLinkLatency
    class: Latency
     type: System
component: Network
   lookup: average -5m unaligned
    units: ms
    every: 1m
     warn: $this > 300
     crit: $this > 500
    delay: down 5m multiplier 1.5 max 1h
  summary: FortiGate SD-WAN ${label:sdwan_healthcheck} latency
     info: SD-WAN health-check ${label:sdwan_healthcheck} on interface ${label:sdwan_interface} has high latency
       to: sysadmin

# SD-WAN link packet loss
 template: fortigate_sdwan_link_packet_loss
       on: snmp.device_prof_fgVWLHealthCheckLinkPacketLoss
    class: Errors
     type: System
component: Network
   lookup: average -5m unaligned
    units: %
    every: 1m
     warn: $this > 1
     crit: $this > 5
    delay: down 5m multiplier 1.5 max 1h
  summary: FortiGate SD-WAN ${label:sdwan_healthcheck} packet loss
     info: SD-WAN health-check ${label:sdwan_healthcheck} on interface ${label:sdwan_interface} has high packet loss
       to: sysadmin

# IPS critical severity events
 template: fortigate_ips_critical_events
       on: snmp.device_prof_fgIpsSeverity
    class: Errors
     type: System
component: Intrusion Prevention
   lookup: average -5m unaligned of critical
    units: {event}/s
    every: 1m
     warn: $this > 0
     crit: $this > 10
    delay: down 5m multiplier 1.5 max 1h
  summary: FortiGate IPS critical events (VDOM ${label:vdom_name})
     info: Critical severity intrusions detected on FortiGate VDOM ${label:vdom_name}
       to: sysadmin

# Link monitor dead
 template: fortigate_link_monitor_dead
       on: snmp.device_prof_fgLinkMonitorState
    class: Errors
     type: System
component: Network
   lookup: average -1m unaligned percentage of alive
    units: %
    every: 10s
     crit: $this < 100
    delay: down 1m multiplier 1.5 max 1h
  summary: FortiGate link monitor ${label:link_monitor} down
     info: Link monitor ${label:link_monitor} reports gateway probe is dead
       to: sysadmin

# Wireless AP offline
 template: fortigate_wireless_ap_offline
       on: snmp.device_prof_fgWcWtpSessionConnectionState
    class: Errors
     type: System
component: Wireless
   lookup: average -1m unaligned percentage of onLine
    units: %
    every: 10s
     warn: $this < 100
    delay: down 5m multiplier 1.5 max 1h
  summary: FortiGate wireless AP ${label:wtp_id} connection
     info: Wireless access point ${label:wtp_id} (model ${label:wtp_model}) is not online
       to: sysadmin