Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials

Alert on Custom Poller Change

We are monitoring Palo Altos and we are trying to setup alerts for App Version Changes and URL Filter Version, we simply what Orion to alert us anytime an update is done to the any of the version files. I am able to get the custom poller to work but I can't seem to get the alerts to work, I have a feeling that the alert is stuck in trigger mode being there is no reset action.

Right now this is the trigger action I have setup

Find more posts tagged with

Accepted answers

All comments

d09h

Any chance the Palo Alto can send an SNMP trap on App Version Changes and URL Filter Version? If so, you could alert on the trap.

https://live.paloaltonetworks.com/t5/tkb/articleprintpage/tkb-id/Management-TKB/article-id/1596

TRAPS
PAN-OS supports the well-known traps, as defined in RFC-1907. Additional traps are sent as configured in the PAN-OS GUI. For example, you can configure the system log messages to be sent via SNMP traps Same is true of the traffic log, threat log, and config log-- each log message can be sent as a trap

RichardLetts

That does not look like the right format for a custom Node Poller alert, I think you need to look at the PollerName

Also, I think the changed operator only works with LastBoot at that version of NPM, but the UI doesn't tell you that.

To do what you want You will need to:

a) collect the values of the OID

b) save history (this could take a lot of database space depending on your polling rate)

c) write a custom SQL alert

This is advanced stuff (I rate this as a double-black-diamond level of difficulty due to the challenge of the SQL to retrieve the last two values in the custom poller history for a node and compare them... actually it might be quicker to pull the list of polled values that are different from the previous one take the top two rows subtract the dates and see if they changed recently.)

d09h's suggestion might also work, but that is almost equally advanced (and gets a black-diamond rating)

d09h

Might be a premature assessment. If Palo Alto logs were triggered by a change, then the system/ traffic/ threat/ config information sent over in the trap (or sent over via syslog perhaps) might actually have the before/ after information. If spyfly can post what the traps look like (or syslogs look like), perhaps they have wording like '...app version change...from...1.2.3...to...1.2.4'. If a trap contained 'app version change', then creating an alert with that condition would be trivial, and the contents of the trap may include the before and the after. This all hinges on what the Palo Alto can send (and that's where my lack of Palo Alto access and experience kick in).

I'm led to believe the Palo Alto side is possible because of the wording in the link I provided:

TRAPS
PAN-OS supports the well-known traps, as defined in RFC-1907. Additional traps are sent as configured in the PAN-OS GUI. For example, you can configure the system log messages to be sent via SNMP traps Same is true of the traffic log, threat log, and config log-- each log message can be sent as a trap

Note that custom MIB polling/ universal device poller type approach may not be necessary at all.

All seems doable based on this:

Forward Traps to an SNMP Manager

The $64,000 question is whether App Version changes and URL Filter version changes are in one or more of these logs: system, traffic, threat, config.

spyfly

harrisa94 take a look at this thread