Availability Monitoring Events

Availability Monitoring Events

AccelOps generates the following events related to availability monitoring

Ping Stat Monitoring

Synthetic Monitoring Success Synthetic Monitoring Failure

Name	Id	Type	Description
Event Type	eventType	string	Event type set to PH_DEV_MON_SYS_PING_STAT
Event Severity	eventSeverity	uint16	Set to 1. In general, a number between 0 (lowest severity) and 10 (highest severity)
Event Severity Category	eventSeverityCat	string	Set to Low. IN general, takes the values Low, Medium and High. Event Severities 0-4 are mapped to Low, 5-8 are mapped to Medium and 9-10 are mapped to High
Event Receive Time	phRecvTime	Date	Time at which AccelOps generated this event
Reporting IP	reptDevIpAddr	Date	IP address of device reporting this event. In this case set to the device reporting the utilization (same as Host name attribute)
Relaying IP	relayDevIpAddr	Date	IP address of device relaying this event from the source to AccelOps. In general it could be a syslog-ng IP address but in this, since AccelOps talks to the device directly, Relaying IP is set to AccelOps IP Address.
Raw Event Log	rawEventMsg	string	Raw event containing all attributes in comma separated “[Attribute] = value” format.
Host name	hostName	string	Host name (as in AccelOps CMDB) of the device whose CPU utilization is being reported
Host IP Address	hostIpAddr	IP	Access IP (as in AccelOps CMDB) of the device whose CPU utilization is being reported
Avg Round Trip Time	avgDurationMSec	uint32	Average Round trip time from the ping tests done during this interval
Max Round Trip Time	maxDurationMSec	uint32	Max Round trip time from the ping tests done during this interval
Min Round Trip Time	minDurationMSec	uint32	Min Round trip time from the ping tests done during this interval
Packet Loss Pct	pktLossPct	double	Packet loss percentage from the ping tests done during this interval
System Down Time	sysDownTime	uint32	Amount of time during this polling interval that there was 100% ping loss
System Degraded Time	sysDegradedTime	uint32	Amount of time during this polling interval that there was 50%+ ping loss
Poll Interval	pollIntv	uint32	Polling interval in seconds

Synthetic Transaction Monitoring Success

Event Type: PH_DEV_MON_EUM_SUCCESS

Description: Successful Synthetic transaction monitoring test Source: All Key Attributes:

Name	Id	Type	Description
Event Type	eventType	string	Event type set to PH_DEV_MON_SYS_EUM_SUCCESS
Event Severity	eventSeverity	uint16	Set to 1. In general, a number between 0 (lowest severity) and 10 (highest severity)
Event Severity Category	eventSeverityCat	string	Set to Low. IN general, takes the values Low, Medium and High. Event Severities 0-4 are mapped to Low, 5-8 are mapped to Medium and 9-10 are mapped to High
Event Receive Time	phRecvTime	Date	Time at which AccelOps generated this event
Reporting IP	reptDevIpAddr	Date	IP address of device reporting this event. In this case set to the device reporting the utilization (same as Host name attribute)
Relaying IP	relayDevIpAddr	Date	IP address of device relaying this event from the source to AccelOps. In general it could be a syslog-ng IP address but in this, since AccelOps talks to the device directly, Relaying IP is set to AccelOps IP Address.
Raw Event Log	rawEventMsg	string	Raw event containing all attributes in comma separated “[Attribute] = value” format.
Host name	hostName	string	Host name (as in AccelOps CMDB) of the device whose CPU utilization is being reported
Host IP Address	hostIpAddr	IP	Access IP (as in AccelOps CMDB) of the device whose CPU utilization is being reported
Synthetic Transaction Monitor Name	endUserMonitorName	string	Name of the Synthetic Transaction Monitor
Synthetic Transaction Monitor Step	endUserMonitorStep	string	Particular step of the Synthetic Transaction Monitor, in case the transaction monitor involves multiple steps.
Application Protocol	appTransportProto	string	Application protocol such as HTTP
Application Port	appPort	string	Port number such as 443
Application Response Time	appResponseTimeMSec	uint32	Synthetic transaction response time (ms)
Poll Interval	pollIntv	uint32	Polling interval in seconds

Synthetic Transaction Monitoring Failure

Event Type: PH_DEV_MON_EUM_FAIL

Description: Failed Synthetic transaction monitoring test Source: All Key Attributes:

Name	Id	Type	Description
Event Type	eventType	string	Event type set to PH_DEV_MON_SYS_EUM_SUCCESS
Event Severity	eventSeverity	uint16	Set to 1. In general, a number between 0 (lowest severity) and 10 (highest severity)
Event Severity Category	eventSeverityCat	string	Set to Low. IN general, takes the values Low, Medium and High. Event Severities 0-4 are mapped to Low, 5-8 are mapped to Medium and 9-10 are mapped to High
Event Receive Time	phRecvTime	Date	Time at which AccelOps generated this event
Reporting IP	reptDevIpAddr	Date	IP address of device reporting this event. In this case set to the device reporting the utilization (same as Host name attribute)

 

Relaying IP	relayDevIpAddr	Date	IP address of device relaying this event from the source to AccelOps. In general it could be a syslog-ng IP address but in this, since AccelOps talks to the device directly, Relaying IP is set to AccelOps IP Address.
Raw Event Log	rawEventMsg	string	Raw event containing all attributes in comma separated “[Attribute] = value” format.
Host name	hostName	string	Host name (as in AccelOps CMDB) of the device whose CPU utilization is being reported
Host IP Address	hostIpAddr	IP	Access IP (as in AccelOps CMDB) of the device whose CPU utilization is being reported
Synthetic Transaction Monitor Name	endUserMonitorName	string	Name of the Synthetic Transaction Monitor test
Synthetic Transaction Monitor Step	endUserMonitorStep	string	Particular step of the Synthetic Transaction Monitor, in case the transaction monitor involves multiple steps.
Application Protocol	appTransportProto	string	Application protocol such as HTTP
Application Port	appPort	string	Port number such as 443
Reason for Error	errReason	uint32	Reason for failed Synthetic Transaction Monitor test
Poll Interval	pollIntv	uint32	Polling interval in seconds

 

 

Having trouble configuring your Fortinet hardware or have some questions you need answered? Check Out The Fortinet Guru Youtube Channel! Want someone else to deal with it for you? Get some consulting from Fortinet GURU!

Disk Growth Trend – Monthly

Event Type: PH_DEV_MON_SYS_DISK_TREND_MONTH

Disk Capacity Util	diskUtil	double	Disk utilization for a specific disk name (between 0-100).
Free Disk (MB)	freeDiskMB	uint32	Size of free disk available in MBytes
Total Disk (MB)	totalDiskMB	uint32	Size of total disk in MBytes
Used Disk (MB)	usedDiskMB	uint32	Size of used disk in MBytes
Current Week Disk Growth (MB)	diskGrowthMBWeekly	double	Disk growth (MB) for the current week
Avg Weekly Disk Growth (MB)	avgDiskGrowthMBWeekly	double	Running avg of weekly disk growth (MB) overall previous days
Days To Disk Full	timeToDiskFull	uint32	Number of days until disk is full (from weekly growth statistics)
Poll Interval	pollIntv	uint32	Polling interval in seconds.

Description: Event containing disk usage growth trend – monthly view Source:

Microsoft Windows (SNMP or WMI), Linux (SNMP), Solaris (SNMP), HP-UX (SNMP), IBM AIX (SNMP) NetApp DataONTAP (SNMP)

Key Attributes:

Name	Id	Type	Description
Event Type	eventType	string	Event type set to PH_DEV_MON_SYS_DISK_TREND_DAY
Event Severity	eventSeverity	uint16	Set to 1. In general, a number between 0 (lowest severity) and 10 (highest severity)
Event Severity Category	eventSeverityCat	string	Set to Low. IN general, takes the values Low, Medium and High. Event Severities 0-4 are mapped to Low, 5-8 are mapped to Medium and 9-10 are mapped to High
Event Receive Time	phRecvTime	Date	Time at which AccelOps generated this event
Reporting IP	reptDevIpAddr	Date	IP address of device reporting this event. In this case set to the device reporting the utilization (same as Host name attribute)
Relaying IP	relayDevIpAddr	Date	IP address of device relaying this event from the source to AccelOps. In general it could be a syslog-ng IP address but in this, since AccelOps talks to the device directly, Relaying IP is set to AccelOps IP Address.
Raw Event Log	rawEventMsg	string	Raw event containing all attributes in comma separated “[Attribute] = value” format.
Host name	hostName	string	Host name (as in AccelOps CMDB) of the device whose disk utilization is being reported
Host IP Address	hostIpAddr	IP	Access IP (as in AccelOps CMDB) of the device whose disk utilization is being reported
Disk Name	diskName	string	Disk name
Disk Capacity Util	diskUtil	double	Disk utilization for a specific disk name (between 0-100).
Free Disk (MB)	freeDiskMB	uint32	Size of free disk available in MBytes
Total Disk (MB)	totalDiskMB	uint32	Size of total disk in MBytes
Used Disk (MB)	usedDiskMB	uint32	Size of used disk in MBytes
Current Monthly Disk Growth (MB)	diskGrowthMBMonthly	double	Disk growth (MB) for the current month
Avg Monthly Disk Growth (MB)	avgDiskGrowthMBMonthly	double	Running avg of monthly disk growth (MB) overall previous months
Days To Disk Full	timeToDiskFull	uint32	Number of days until disk is full (from monthly growth statistics)
Poll Interval	pollIntv	uint32	Polling interval in seconds.

 

Having trouble configuring your Fortinet hardware or have some questions you need answered? Check Out The Fortinet Guru Youtube Channel! Want someone else to deal with it for you? Get some consulting from Fortinet GURU!

Disk Growth Trend – Weekly

Event Type: PH_DEV_MON_SYS_DISK_TREND_WEEK

Description: Event containing disk usage growth trend – weekly view Source:

Microsoft Windows (SNMP or WMI), Linux (SNMP), Solaris (SNMP), HP-UX (SNMP), IBM AIX (SNMP) NetApp DataONTAP (SNMP)

Key Attributes:

Name	Id	Type	Description
Event Type	eventType	string	Event type set to PH_DEV_MON_SYS_DISK_TREND_DAY
Event Severity	eventSeverity	uint16	Set to 1. In general, a number between 0 (lowest severity) and 10 (highest severity)
Event Severity Category	eventSeverityCat	string	Set to Low. IN general, takes the values Low, Medium and High. Event Severities 0-4 are mapped to Low, 5-8 are mapped to Medium and 9-10 are mapped to High
Event Receive Time	phRecvTime	Date	Time at which AccelOps generated this event
Reporting IP	reptDevIpAddr	Date	IP address of device reporting this event. In this case set to the device reporting the utilization (same as Host name attribute)
Relaying IP	relayDevIpAddr	Date	IP address of device relaying this event from the source to AccelOps. In general it could be a syslog-ng IP address but in this, since AccelOps talks to the device directly, Relaying IP is set to AccelOps IP Address.
Raw Event Log	rawEventMsg	string	Raw event containing all attributes in comma separated “[Attribute] = value” format.
Host name	hostName	string	Host name (as in AccelOps CMDB) of the device whose disk utilization is being reported
Host IP Address	hostIpAddr	IP	Access IP (as in AccelOps CMDB) of the device whose disk utilization is being reported
Disk Name	diskName	string	Disk name

Having trouble configuring your Fortinet hardware or have some questions you need answered? Check Out The Fortinet Guru Youtube Channel! Want someone else to deal with it for you? Get some consulting from Fortinet GURU!

Disk Growth Trend – Daily

Event Type: PH_DEV_MON_SYS_DISK_TREND_DAY

Description: Event containing disk usage growth trend – daily view Source:

Microsoft Windows (SNMP or WMI), Linux (SNMP), Solaris (SNMP), HP-UX (SNMP), IBM AIX (SNMP) NetApp DataONTAP (SNMP)

Key Attributes:

Event Severity Category	eventSeverityCat	string	Set to Low. IN general, takes the values Low, Medium and High. Event Severities 0-4 are mapped to Low, 5-8 are mapped to Medium and 9-10 are mapped to High
Event Receive Time	phRecvTime	Date	Time at which AccelOps generated this event
Reporting IP	reptDevIpAddr	Date	IP address of device reporting this event. In this case set to the device reporting the utilization (same as Host name attribute)
Relaying IP	relayDevIpAddr	Date	IP address of device relaying this event from the source to AccelOps. In general it could be a syslog-ng IP address but in this, since AccelOps talks to the device directly, Relaying IP is set to AccelOps IP Address.
Raw Event Log	rawEventMsg	string	Raw event containing all attributes in comma separated “[Attribute] = value” format.
Host name	hostName	string	Host name (as in AccelOps CMDB) of the device whose disk utilization is being reported
Host IP Address	hostIpAddr	IP	Access IP (as in AccelOps CMDB) of the device whose disk utilization is being reported
Disk Name	diskName	string	Disk name
Disk Capacity Util	diskUtil	double	Disk utilization for a specific disk name (between 0-100).
Free Disk (MB)	freeDiskMB	uint32	Size of free disk available in MBytes
Total Disk (MB)	totalDiskMB	uint32	Size of total disk in MBytes
Used Disk (MB)	usedDiskMB	uint32	Size of used disk in MBytes
Current Daily Disk Growth (MB)	diskGrowthMBDaily	double	Disk growth (MB) for the current day
Avg Daily Disk Growth (MB)	avgDiskGrowthMBDaily	double	Running avg of daily disk growth (MB) overall previous days
Days To Disk Full	timeToDiskFull	uint32	Number of days until disk is full (from daily growth statistics)
Poll Interval	pollIntv	uint32	Polling interval in seconds.

Having trouble configuring your Fortinet hardware or have some questions you need answered? Check Out The Fortinet Guru Youtube Channel! Want someone else to deal with it for you? Get some consulting from Fortinet GURU!

Network Interface Monitoring

Event Type: PH_DEV_MON_NET_INTF_UTIL

Description: Event containing network interface utilization metrics Source – almost all devices via SNMP:

Cisco IOS (SNMP), , Cisco NX-OS, Extreme ExtremeOS, Foundry Ironware, HP ProCurve

Cisco ASA/PIX/FWSM (SNMP), Checkpoint FW-1, Juniper SSG/ISG, Palo Alto Firewall, Sonicwall SonicOS, Fortinet FortiOS Cisco IPS (SNMP), Tippingpoint IPS (SNMP)

NetApp DataONTAP (SNMP)

Microsoft Windows (SNMP or WMI), Linux (SNMP), Solaris (SNMP), HP-UX (SNMP), IBM AIX (SNMP)

Sample event

[PH_DEV_MON_NET_INTF_UTIL]:[eventSeverity]=PHL_INFO,[fileName]=phIn tfFilter.cpp,[lineNumber]=275,[intfName]=GigabitEthernet4/41,[intfA lias]=Connection to Internet,[hostName]=SJ-Main-Cat6500,[hostIpAddr]=192.168.0.1,[pollI ntv]=177,[recvBytes]=0,[recvBitsPerSec]=0.000000,[inIntfUtil]=0.000 000,[sentBytes]=0,[sentBitsPerSec]=0.000000,[outIntfUtil]=0.000000,

[recvPkts]=0,[sentPkts]=0,[inIntfPktErr]=0,[inIntfPktErrPct]=0.0000 00,[outIntfPktErr]=0,[outIntfPktErrPct]=0.000000,[inIntfPktDiscarde d]=0,[inIntfPktDiscardedPct]=0.000000,[outIntfPktDiscarded]=0,[outI ntfPktDiscardedPct]=0.000000,[outQLen]=0,[intfSpeed64]=1000000000,[ intfAdminStatus]=up,[intfOperStatus]=down,[daysSinceLastUse]=487,[p hLogDetail]=

Key Attributes:

Name	Id	Type	Description
Event Type	eventType	string	Event type set to PH_DEV_MON_NET_INTF_UTIL
Event Severity	eventSeverity	uint16	Set to 1. In general, a number between 0 (lowest severity) and 10 (highest severity)
Event Severity Category	eventSeverityCat	string	Set to Low. IN general, takes the values Low, Medium and High. Event Severities 0-4 are mapped to Low, 5-8 are mapped to Medium and 9-10 are mapped to High
Event Receive Time	phRecvTime	Date	Time at which AccelOps generated this event
Reporting IP	reptDevIpAddr	Date	IP address of device reporting this event. In this case set to the device reporting the utilization (same as Host name attribute)
Relaying IP	relayDevIpAddr	Date	IP address of device relaying this event from the source to AccelOps. In general it could be a syslog-ng IP address but in this, since AccelOps talks to the device directly, Relaying IP is set to AccelOps IP Address.

 

Raw Event Log	rawEventMsg	string	Raw event containing all attributes in comma separated “[Attribute] = value” format.
Host name	hostName	string	Host name (as in AccelOps CMDB) of the device whose CPU utilization is being reported
Host IP Address	hostIpAddr	IP	Access IP (as in AccelOps CMDB) of the device whose CPU utilization is being reported
Host Intf Name	intfName	string	The name of the network interface for which this statistics applies
In Intf Util	inIntfUtil	double	Inbound (or received) network utilization (between 0-100).
Received Bytes	recvBytes	uint32	Inbound (or received) bytes during this interval
Received Byte Rate (/sec)	recvBytesPerSec	double	Inbound (or received) byte rate during this interval
Received Packets	recvPkts	uint32	Inbound (or received) packets received during this interval
In Packet Error	inIntfPktErr	uint32	Inbound (or received) packet errors
In Packet Error Pct	inIntfPktErrPct	double	Inbound (or received) packet error as a percentage of total packets
In Packet Discards	inIntfPktDiscarded	uint32	Inbound (or received) packet discarded
In Packet Discard Pct	inIntfPktDiscardedPct	double	Inbound (or received) packet discarded as a percentage of total packets
Out Intf Util	outIntfUtil	double	Outbound (or sent) network utilization (between 0-100).
Sent Bytes	sentBytes	uint32	Outbound (or sent) bytes during this interval
Sent Byte Rate (/sec)	sentBytesPerSec	double	Inbound (or received) byte rate during this interval
Sent Packets	sentPkts	uint32	Outbound (or sent) packets sent during this interval
Out Packet Error	outIntfPktErr	double	Outbound (or sent) packet errors
Out Packet Error Pct	outIntfPktErrPct	double	Outbound (or sent) packet error as a percentage of total packets
Out Packet Discards	outIntfPktDiscarded	uint32	Outbound (or sent) packet discarded
Out Packet Discard Pct	outIntfPktDiscardedPct	double	Outbound (or sent) packet discarded as a percentage of total packets
Out Queue Length	outQLen	uint32	Length of output queue
Poll Interval	pollIntv	uint32	Polling interval in seconds

 

 

Name	Id	Type	Description
Event Type	eventType	string	Event type set to PH_DEV_MON_SYS_DISK_TREND_DAY
Event Severity	eventSeverity	uint16	Set to 1. In general, a number between 0 (lowest severity) and 10 (highest severity)

Having trouble configuring your Fortinet hardware or have some questions you need answered? Check Out The Fortinet Guru Youtube Channel! Want someone else to deal with it for you? Get some consulting from Fortinet GURU!

Disk I/O Monitoring

Event Type: PH_DEV_MON_DISK_IO_UTIL

Description: Event containing disk utilization metrics Source:

Microsoft Windows (WMI), Linux (SSH), HP-UX (SSH), IBM AIX (SSH)

NetApp DataONTAP (SNMP)

Key Attributes:

Name	Id	Type	Description
Event Type	eventType	string	Event type set to PH_DEV_MON_DISK_IO_UTIL
Event Severity	eventSeverity	uint16	Set to 1. In general, a number between 0 (lowest severity) and 10 (highest severity)
Event Severity Category	eventSeverityCat	string	Set to Low. IN general, takes the values Low, Medium and High. Event Severities 0-4 are mapped to Low, 5-8 are mapped to Medium and 9-10 are mapped to High
Event Receive Time	phRecvTime	Date	Time at which AccelOps generated this event
Reporting IP	reptDevIpAddr	Date	IP address of device reporting this event. In this case set to the device reporting the utilization (same as Host name attribute)
Relaying IP	relayDevIpAddr	Date	IP address of device relaying this event from the source to AccelOps. In general it could be a syslog-ng IP address but in this, since AccelOps talks to the device directly, Relaying IP is set to AccelOps IP Address.
Raw Event Log	rawEventMsg	string	Raw event containing all attributes in comma separated “[Attribute] = value” format.
Host name	hostName	string	Host name (as in AccelOps CMDB) of the device whose disk utilization is being reported
Host IP Address	hostIpAddr	IP	Access IP (as in AccelOps CMDB) of the device whose disk utilization is being reported
Disk Name	diskName	string	Disk name
Disk Read Rate (KBps)	diskReadKBytesPerSec	double	Disk read rate in KBytes/sec.
Disk Write Rate (KBps)	diskWriteKBytesPerSec	double	Disk write rate in KBytes/sec.
Disk Read Rate (/sec)	diskReadReqPerSec	double	Disk read rate in read IO per sec.
Disk Write Rate (/sec)	diskWriteReqPerSec	double	Disk write rate in write IO per sec.
Disk IO Util	diskIOUtil	double	Disk I/O utilization
Disk Read Latency (ms)	devDiskRdLatency	double	Disk Read Latency – for Windows (WMI) only
Disk Write Latency (ms)	devDiskWrLatency	double	Disk Write latency – for Windows (WMI) only
Disk Queue Length	diskQLen	uint32	Disk Queue Length – for Windows (WMI) only
Poll Interval	pollIntv	uint32	Polling interval in seconds.

Having trouble configuring your Fortinet hardware or have some questions you need answered? Check Out The Fortinet Guru Youtube Channel! Want someone else to deal with it for you? Get some consulting from Fortinet GURU!

Disk space Monitoring

Event Type: PH_DEV_MON_SYS_DISK_UTIL

Description: Event containing disk utilization metrics Source:

Microsoft Windows (SNMP or WMI), Linux (SNMP), Solaris (SNMP), HP-UX (SNMP), IBM AIX (SNMP) NetApp DataONTAP (SNMP)

Key Attributes:

Reporting IP	reptDevIpAddr	Date	IP address of device reporting this event. In this case set to the device reporting the utilization (same as Host name attribute)
Relaying IP	relayDevIpAddr	Date	IP address of device relaying this event from the source to AccelOps. In general it could be a syslog-ng IP address but in this, since AccelOps talks to the device directly, Relaying IP is set to AccelOps IP Address.
Raw Event Log	rawEventMsg	string	Raw event containing all attributes in comma separated “[Attribute] = value” format.
Host name	hostName	string	Host name (as in AccelOps CMDB) of the device whose disk utilization is being reported
Host IP Address	hostIpAddr	IP	Access IP (as in AccelOps CMDB) of the device whose disk utilization is being reported
Disk Name	diskName	string	Disk name
Disk Capacity Util	diskUtil	double	Disk utilization for a specific disk name (between 0-100).
Free Disk (MB)	freeDiskMB	uint32	Size of free disk available in MBytes
Total Disk (MB)	totalDiskMB	uint32	Size of total disk in MBytes
Used Disk (MB)	usedDiskMB	uint32	Size of used disk in MBytes
Poll Interval	pollIntv	uint32	Polling interval in seconds.

Having trouble configuring your Fortinet hardware or have some questions you need answered? Check Out The Fortinet Guru Youtube Channel! Want someone else to deal with it for you? Get some consulting from Fortinet GURU!

AccelOps Generated Event Format

AccelOps Generated Events

AccelOps is an event based analytics system. When it monitors systems and applications, it produces events containing the collected metrics this section describes details of such events. This can used to write custom queries, reports and rules.

System Performance Monitoring Events

Availability Monitoring Events

VMware Monitoring Events

Hardware Monitoring Events

Application Monitoring Events

Network Flow Monitoring Events

Security Information Management

System Performance Monitoring Events

System Performance Monitoring Events

AccelOps generates the following events related to system monitoring events

CPU Monitoring Event

Memory Monitoring

Disk space Monitoring

Disk I/O Monitoring

Network I/O Monitoring

Disk Growth Trend – Daily

Disk Growth Trend – Weekly

Disk Growth Trend – Monthly

CPU Monitoring

Event Type: PH_DEV_MON_SYS_CPU_UTIL

Description: Event containing CPU utilization metrics

Cisco IOS (SNMP), , Cisco NX-OS, Extreme ExtremeOS, Foundry Ironware, HP ProCurve

Cisco ASA/PIX/FWSM (SNMP), Checkpoint FW-1, Juniper SSG/ISG, Palo Alto Firewall, Sonicwall SonicOS, Fortinet FortiOS Cisco IPS (SNMP), Tippingpoint IPS (SNMP)

NetApp DataONTAP

Microsoft Windows (SNMP, WMI), Linux (SNMP), Solaris (SNMP), HP-UX (SNMP), IBM AIX (SNMP) Key Attributes:

Name	Id	Type	Description
Event Type	eventType	string	Event type set to PH_DEV_MON_SYS_CPU_UTIL
Event Severity	eventSeverity	uint16	Set to 1. In general, a number between 0 (lowest severity) and 10 (highest severity)
Event Severity Category	eventSeverityCat	string	Set to Low. IN general, takes the values Low, Medium and High. Event Severities 0-4 are mapped to Low, 5-8 are mapped to Medium and 9-10 are mapped to High
Event Receive Time	phRecvTime	Date	Time at which AccelOps generated this event
Reporting IP	reptDevIpAddr	Date	IP address of device reporting this event. In this case set to the device reporting the utilization (same as Host name attribute)
Relaying IP	relayDevIpAddr	Date	IP address of device relaying this event from the source to AccelOps. In general it could be a syslog-ng IP address but in this, since AccelOps talks to the device directly, Relaying IP is set to AccelOps IP Address.
Raw Event Log	rawEventMsg	string	Raw event containing all attributes in comma separated “[Attribute] = value” format.
Host name	hostName	string	Host name (as in AccelOps CMDB) of the device whose CPU utilization is being reported
Host IP Address	hostIpAddr	IP	Access IP (as in AccelOps CMDB) of the device whose CPU utilization is being reported
CPU utilization	cpuUtil	double	Overall CPU utilization (between 0-100). The number is an average over all CPUs in a multi-cpu system.
User CPU Utilization	sysCpuUtil	double	User CPU utilization (between 0-100). The number is an average over all CPUs in a multi-cpu system. Av ailable for Linux (via SNMP) only.
System CPU Utilization	userCpuUtil	double	System CPU utilization (between 0-100). The number is an average over all CPUs in a multi-cpu system. Available for Linux (via SNMP) only.
Poll Interval	pollIntv	uint32	Polling interval in seconds

Memory Monitoring

Event Type: PH_DEV_MON_SYS_MEM_UTIL

Description: Event containing system memory utilization metrics Source:

Cisco IOS (SNMP), , Cisco NX-OS, Extreme ExtremeOS, Foundry Ironware, HP ProCurve

 

Cisco ASA/PIX/FWSM (SNMP), Checkpoint FW-1, Juniper SSG/ISG, Palo Alto Firewall, Sonicwall SonicOS, Fortinet FortiOS Cisco IPS (SNMP), Tippingpoint IPS (SNMP)

Name	Id	Type	Description
Event Type	eventType	string	Event type set to PH_DEV_MON_SYS_DISK_UTIL
Event Severity	eventSeverity	uint16	Set to 1. In general, a number between 0 (lowest severity) and 10 (highest severity)
Event Severity Category	eventSeverityCat	string	Set to Low. IN general, takes the values Low, Medium and High. Event Severities 0-4 are mapped to Low, 5-8 are mapped to Medium and 9-10 are mapped to High
Event Receive Time	phRecvTime	Date	Time at which AccelOps generated this event

Microsoft Windows (SNMP, WMI), Linux (SNMP,SSH), Solaris (SNMP), HP-UX (SNMP,SSH), IBM AIX (SNMP,SSH) Key Attributes:

Name	Id	Type	Description
Event Type	eventType	string	Event type set to PH_DEV_MON_SYS_MEM_UTIL
Event Severity	eventSeverity	uint16	Set to 1. In general, a number between 0 (lowest severity) and 10 (highest severity)
Event Severity Category	eventSeverityCat	string	Set to Low. IN general, takes the values Low, Medium and High. Event Severities 0-4 are mapped to Low, 5-8 are mapped to Medium and 9-10 are mapped to High
Event Receive Time	phRecvTime	Date	Time at which AccelOps generated this event
Reporting IP	reptDevIpAddr	Date	IP address of device reporting this event. In this case set to the device reporting the utilization (same as Host name attribute)
Relaying IP	relayDevIpAddr	Date	IP address of device relaying this event from the source to AccelOps. In general it could be a syslog-ng IP address but in this, since AccelOps talks to the device directly, Relaying IP is set to AccelOps IP Address.
Raw Event Log	rawEventMsg	string	Raw event containing all attributes in comma separated “[Attribute] = value” format.
Host name	hostName	string	Host name (as in AccelOps CMDB) of the device whose memory utilization is being reported
Host IP Address	hostIpAddr	IP	Access IP (as in AccelOps CMDB) of the device whose memory utilization is being reported
Memory utilization	memUtil	double	Overall system physical memory utilization (between 0-100).
Buffer Memory (KB)	bufMemKB	uint32	Size of buffered memory. Available for Linux (via SNMP) only.
Cache Memory (KB)	cacheMemKB	uint32	Size of cached memory. Available for Linux (via SNMP) only.
Swap memory Utilization	swapMemUtil	double	Swap Memory Utilization. Available for Linux (via SNMP) only.
Free Swap Memory (KB)	freeSwapMemKB	uint32	Free Swap Memory. Available for Linux (via SNMP) only.
Swap Read Rate (Pages/sec)	swapInRate	double	Rate at which pages are swapped in. Available for Windows (WMI), Linux (SSH), HP-UX (SSH), IBM AIX (SSH).
Swap Write Rate (Pages/sec)	swapOutRate	double	Rate at which pages are swapped out. Available for Windows (WMI), Linux (SSH), HP-UX (SSH), IBM AIX (SSH).
Poll Interval	pollIntv	uint32	Polling interval in seconds.

Having trouble configuring your Fortinet hardware or have some questions you need answered? Check Out The Fortinet Guru Youtube Channel! Want someone else to deal with it for you? Get some consulting from Fortinet GURU!