system

// The load of a FortiGate, by SNMP (FORTINET-FORTIGATE-MIB, fgSystemInfo): its processor, its memory, its
// sessions and the rate at which new ones open. FortiOS enters its conserve mode when the memory runs
// high, and then stops inspecting new traffic: the memory watch raises before.
need('protocol:snmp');

output('cpu-busy', 'number', array('label' => 'Processor load', 'unit' => '%'));
output('memory-used-percent', 'number', array('label' => 'Memory used', 'unit' => '%'));
output('sessions', 'number', array('label' => 'Sessions'));
output('session-rate', 'number', array('label' => 'New sessions', 'unit' => 'sessions/s'));

watch.above('cpu-high', 'Processor saturated', 'cpu-busy', array('warning' => 80, 'critical' => 90, 'for' => '3 runs'));
watch.above('memory-high', 'Memory saturated', 'memory-used-percent', array('warning' => 80, 'critical' => 88, 'for' => '3 runs'));
watch.habit('sessions-unusual', 'Unusual number of sessions', 'sessions', array('floor' => 1000, 'enabled' => false));
watch.above('session-rate-high', 'Session rate high', 'session-rate', array(
    'help'    => 'Raises beyond the rate set on the probe: the rate a FortiGate takes depends on its model.',
    'enabled' => false,
));

// fgSysCpuUsage and fgSysMemUsage, in percent; fgSysSesCount, the sessions open; fgSysSesRate1, the new
// sessions per second, averaged over the last minute.
value('cpu-busy', snmp.get('1.3.6.1.4.1.12356.101.4.1.3.0'));
value('memory-used-percent', snmp.get('1.3.6.1.4.1.12356.101.4.1.4.0'));
value('sessions', snmp.get('1.3.6.1.4.1.12356.101.4.1.8.0'));
value('session-rate', snmp.get('1.3.6.1.4.1.12356.101.4.1.11.0'));