FortiSIEM Application Monitoring Events

Event Type: PH_DEV_MON_IPSLA_VOIP_MET

Description: Event containing IP SLA metrics Source:

Cisco IOS Key Attributes:

 

Event Severity eventSeverity uint16 Set to 1. In general, a number between 0 (lowest severity) and 10 (highest severity)
Event Severity

Category

eventSeverityCat string Set to Low. IN general, takes the values Low, Medium and High. Event Severities 0-4 are mapped to Low, 5-8 are mapped to Medium and 9-10 are mapped to High
Event Receive Time phRecvTime Date Time at which AccelOps generated this event
Reporting IP reptDevIpAddr IP IP address of device reporting this event. In this case set to the device reporting the utilization (same as Host name attribute)
Relaying IP relayDevIpAddr IP IP address of device relaying this event from the source to AccelOps. In general it could be a syslog-ng IP address but in this, since AccelOps talks to the device directly, Relaying IP is set to AccelOps IP Address.
Raw Event Log rawEventMsg string Raw event containing all attributes in comma separated “[Attribute] = value” format.
Source IP Address srcIpAddr string Source IP Address in the IP SLA test
Source Name srcName IP Host Name of Source IP as in AccelOps CMDB – this is not reported in IP SLA but inserted by AccelOps during event processing
Destination IP

Address

destIpAddr string Destination IP Address in the IP SLA test (the peer IP SLA gateway)
Destination Name destName string Host Name of DestinationIP as in AccelOps CMDB – this is not reported in IP SLA but inserted by AccelOps during event processing
Source TCP/UDP

Port

srcIpPort uint16 Source TCP/UDP Port as in IP SLA test
Destination

TCP/UDP Port

destIpPort uint16 Destination TCP/UDP Port as in IP SLA test
IP SLA Protocol ipSLAProto string
VoIP Codec codec string
Average Round Trip

Time (RTT) (msec)

avgDurationMSec uint32
Max Round Trip

Time (RTT) (msec)

maxDurationMsec uint32
Min Round Trip

Time (RTT) (msec)

minDurationMsec uint32
Average Jitter

(msec)

avgJitterMs uint32
Max Jitter (msec) maxJitterMs uint32
Min Jitter (msec) minJitterMs uint32
Average Jitter

Source to

Destination (msec)

avgJitterSDMs uint32
Max Jitter Source to

Destination (msec)

maxJitterSDMs uint32
Min Jitter Source to

Destination (msec)

minJitterSDMs uint32
Average Jitter

Destination to

Source (msec)

avgJitterDSMs uint32
Max Jitter

Destination to

Source (msec)

maxJitterDSMs uint32
Min Jitter

Destination to

Source (msec)

minJitterDSMs uint32
Packets Lost pktLost uint32
Packets Lost

Source to

Destination

pktLostSD uint32
Packets Lost

Destination to

Source

pktLostDS uint32

 

Packets Missing In

Action

pktMIA uint32
Packets Late pktLate uint32
Packets Out of

Sequence

pktOutSeq uint32
VoIP MOS Score mosScore double
VoIP ICPIF Score icpifScore uint32

IP SLA HTTP Metrics

Event Type: PH_DEV_MON_IPSLA_HTTP_MET

Description: Event containing HTTP IP SLA metrics Source: Cisco IOS (SNMP) Key Attributes:

Name Id Type Description
Event Type eventType string Event type set to PH_DEV_MON_IPSLA_HTTP_MET
Event Severity eventSeverity uint16 Set to 1. In general, a number between 0 (lowest severity) and 10 (highest severity)
Event Severity

Category

eventSeverityCat string Set to Low. IN general, takes the values Low, Medium and High. Event Severities 0-4 are mapped to Low, 5-8 are mapped to Medium and 9-10 are mapped to High
Event Receive Time phRecvTime Date Time at which AccelOps generated this event
Reporting IP reptDevIpAddr IP IP address of device reporting this event. In this case set to the device reporting the utilization (same as Host name attribute)
Relaying IP relayDevIpAddr IP IP address of device relaying this event from the source to AccelOps. In general it could be a syslog-ng IP address but in this, since AccelOps talks to the device directly, Relaying IP is set to AccelOps IP Address.
Raw Event Log rawEventMsg string Raw event containing all attributes in comma separated “[Attribute] = value” format.
Source IP Address srcIpAddr string Source IP Address in the IP SLA test
Source Name srcName IP Host Name of Source IP as in AccelOps CMDB – this is not reported in IP SLA but inserted by AccelOps during event processing
Destination IP

Address

destIpAddr string Destination IP Address in the IP SLA test (the peer IP SLA gateway)
Destination Name destName string  Host Name of DestinationIP as in AccelOps CMDB – this is not reported in IP SLA but inserted by AccelOps during event processing
Source TCP/UDP

Port

srcIpPort uint16  Source TCP/UDP Port as in IP SLA test
Destination

TCP/UDP Port

destIpPort uint16  Destination TCP/UDP Port as in IP SLA test
IP SLA Protocol ipSLAProto string
HTTP Response

Time (msec)

httpResponseTimeMs uint32
DNS Response Time

(msec)

dnsResponseTimeMs uint32
TCP Connect response Time (msec) tcpConnectResponseTimeMs uint32
HTTP Transaction

Response Time

(msec)

httpTransactResponseTimeMs uint32
IPSLA HTTP Status ipslaHttpStatus uint32
IPSLA Status

Description

ipslaHttpStatusDesc string
HTTP Status Code httpStatusCode string

Tomcat Application Server Performance Metrics

There are 7 events that captures various metrics

PH_DEV_MON_TOMCAT_CPU – CPU usage related metrics

PH_DEV_MON_TOMCAT_MEMORY – Memory usage related metrics

PH_DEV_MON_TOMCAT_SERVLET – Servlet usage related metrics

PH_DEV_MON_TOMCAT_SESSION – Session usage related metrics

PH_DEV_MON_TOMCAT_DB – Database usage related metrics

PH_DEV_MON_TOMCAT_THREAD_POOL – Thread pool related metrics

PH_DEV_MON_TOMCAT_REQUEST_PROCESSOR – Request Processor related metrics

The details for each event is below


Having trouble configuring your Fortinet hardware or have some questions you need answered? Check Out The Fortinet Guru Youtube Channel! Want someone else to deal with it for you? Get some consulting from Fortinet GURU!

This entry was posted in Administration Guides, FortiSIEM on by .

About Mike

Michael Pruett, CISSP has a wide range of cyber-security and network engineering expertise. The plethora of vendors that resell hardware but have zero engineering knowledge resulting in the wrong hardware or configuration being deployed is a major pet peeve of Michael's. This site was started in an effort to spread information while providing the option of quality consulting services at a much lower price than Fortinet Professional Services. Owns PacketLlama.Com (Fortinet Hardware Sales) and Office Of The CISO, LLC (Cybersecurity consulting firm).

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.