CheckPoint SI Percentage OID

Version 1

    This may be very common knowledge among the MIB Masters but I just wanted to post this very brief configuration to help some poor soul that has the configure a poller to capture the SI of a CheckPoint Firewall as a percentage.

     

    To spare you all a long story, I performed a brute force review of an SNMP walk in desperation and fought for hours to find an OID that would report on the System Interrupts for a CPU in a CheckPoint device. This was requested by our client who was replacing a Cacti server with a Solarwinds monitoring system.

     

    So for all of you about to pull out your hair, try the following OIDs and transformer to see if that gets the results you want. If else, hang in there and look to the SNMP-walk. It is very possible that the feature you are looking to poll on is not supported by your device or the version of SNMP polling. Above all else, don’t forget to breathe.

     

    ****Disclaimer**** These OIDs will not work with every Checkpoint. Makes sure you perform a SNMP Walk on the desired device to get a list of the MIBs that are compatible with your device.

     

     

    CheckPoint SI time:

     

    1.3.6.1.4.1.2021.11.56 ssCpuRawInterrupts: interruptlevel CPU time. BSD

    1.3.6.1.4.1.2021.11.52 ssCpuRawSystem: system CPU time

     

    Convert with the following:

    100*({ssCpuRawInterrupt}/{ssCpuRawSystem})

     

    In our environment we have it polling every 5 minutes and created an alert with the following conditions:

     

    Alert on:

    Custom Node Poller

     

    Scope of Alert:

    Only following sets of objects

    Node | DeviceType| is equal to | CheckPoint Firewall

     

    The actual trigger condition:

    All Child conditions must be satisfied (AND)

     

    Custom Node Poller | Unique Name (Custom Poller) | is equal to | {your converted poller}

    Custom Node Poller | Current Numeric Value | is greater than or equal to | 45

     

    Condition must exist for more than 30 Minutes