This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.
You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

How to pass custom poller value in Alert message

Created a property monitor of Custom Node Poller in Advanced Alerts to set up an alert that triggers when a VPN tunnel is down.

I applied OIDs to a Fortinet node, for the tunnel state, fgVpnTunEntStatus (1=down or 2=up) as Raw value, Format: none, Get, and for the tunnel names to pass,  fgVpnTunEntPhase1Name,  and fgVpnTunentPhase2Name both as Raw value, Format: Text, Get 


I want to have the alert message sent to simply indicate something like:


The VPN to [Value from the OID 1.3.6.1.4.1.12356.101.12.2.2.1.2

(fgVPNTunentPhase1Name) on Node (Value) is Down.

I created an alert to simply pass as many variables as I could to see where to find how to include the (fgVPNTunentPhase1Name), and to determine which values are available to build the alert.

Alert.PNG

It triggers properly, but can't figure out how to a.)  include the tunnel name variables to pass into the alert message, and b.) which is correct variable to pass showing the tunnel status (i.e. 1=down).In order to trigger the alert, I set condition to not equal to down, since the tunnel being tested is up, so I assume the '2' values in #5 or #28 would be correct for that? How do I get the Tunnel name out from a variable?

Here's the list of variables that were available, followed by the corresponding output of the actual alert.

Fortinet variables side by side.PNG

Suggestions appreciated, or am I looking at building a custom SQL alert to accomplish this?

  • I would adjust your udnp poller to do an enumeration map to map the values to up or down.  That will allow you to send the "friendly" status in the alert.  However, it looks like this poller does not poll the name of the tunnel.

    There are a couple of ways that you can do this:

    1) Create a poller that polls the entire VPN connection tunnel.  I don't have a fortinet device, so I can't confirm, but it looks like your table will be 1.3.6.1.4.1.12356.101.12.2. I also have never setup up an alert a tabular poller.

    2) If you don't have many VPN's that you are trying to monitor, you can set up a poller for both the VPN name and the the vpn status.  You'll have to use the results from the table in option 1.  Name each poller uniquely for the vpn.  Then, for the alert, you poll the status.  Then to get the name, you would use the ${SQL: <sql query>} to execute a sql query in the alert provide the correct name.  I currently do something similar to this include in my down alerts for a site if the ups for the location went on to battery. I'll include the details of this below.  If you would like a little guidance on building the query, I'll try to help if I can find time.

    Example of alert: I have custom properties called Location_Name and AlertGroup.  My ups device are in an alert group called "UPS".  If a ups is not present at the location, I map the value to UPS NOT PRESENT.

    ${SQL:SELECT TOP 1 CustomPollerAssignmentView.CurrentValue  FROM (CustomPollerStatus INNER JOIN CustomPollerAssignmentView ON (CustomPollerStatus.CustomPollerAssignmentID = CustomPollerAssignmentView.CustomPollerAssignmentID))  INNER JOIN Nodes ON (CustomPollerAssignmentView.NodeID = Nodes.NodeID) Where (Location_Name='${Location_Name}' and AlertGroup='UPS') AND CustomPollerAssignmentView.CustomPollerName='upsOutputSource' Union Select 'NO UPS PRESENT' Where NOT Exists (SELECT 1 FROM (CustomPollerStatus INNER JOIN CustomPollerAssignmentView ON (CustomPollerStatus.CustomPollerAssignmentID = CustomPollerAssignmentView.CustomPollerAssignmentID))  INNER JOIN Nodes ON (CustomPollerAssignmentView.NodeID = Nodes.NodeID) Where (Location_Name='${Location_Name}' and AlertGroup='UPS') AND CustomPollerAssignmentView.CustomPollerName='upsOutputSource')}

    You'll see that this is two separate queries joined by the union.  The 2nd query is nearly identical the first and is used to return NO UPS PRESENT is there are no rows returned in the query.

    One of the item to note.  There cannot be any carriage returns in your query due to the way alert manager parsers the query.

    Hope this helps.

  • You need to check for inset variables on your trigger action page, to make this easy assuming you already have the custom values you require (you have created undp pollers for the same). Go to Trigger action and check for the variables available for you to insert in your alert , build the variables you are interested in and add them onto your alert

    Alert1.JPG

    Alert2.JPG

    You would see "Variable category" column and "Select a variable" , select the one's you require and click on "Build Selected Variable".

    Use the same variable in your alert

    Hope this helps

  • Thanks for the detailed answer. I'm working on this with a colleague and will surely circle back with you for input/assist. Appreciate your time!

  • Vinay, Thanks but my post shows those variables I'm already pulling and limitation I ran into for how to include the tunnel name. Appreciate your input.