banshee/network-collection/network/fortinet/snmp/system

Load of a FortiGate, by SNMP

Returns the processor load of a FortiGate, its memory used, its sessions and the rate at which new sessions open. Four watches are offered: the processor saturated, the memory saturated, an unusual number of sessions, and a session rate too high.

Versions

FortiOS 5, 6 and 7, which serve these objects alike. It stays at the common level of fortinet/.

How it works

The collector reads four values of fgSystemInfo (FORTINET-FORTIGATE-MIB):

fgSysCpuUsage, the processor load, in percent;
fgSysMemUsage, the memory used, in percent;
fgSysSesCount, the sessions open;
fgSysSesRate1, the new sessions per second, averaged over the last minute.

FortiOS enters its conserve mode when the memory runs high (88 % used by default), and then stops inspecting new traffic: "Memory saturated" is critical from that threshold, and warns before.

The collector only reads: SNMP sends nothing but reads.

Prerequisites

SNMP enabled on the FortiGate (config system snmp sysinfo, and the interface that answers it allowing SNMP), reachable from the poller (UDP 161), a community or a user restricted to the poller.
Read-only access, SNMPv2c or SNMPv3, set on the host or one of its folders (protocol:snmp:* variables).

Outputs

Name	Label	Unit	Per instance
`cpu-busy`	Overall processor usage	%	no
`memory-used-percent`	Used memory	%	no
`sessions`	Sessions	—	no
`session-rate`	New sessions	sessions/s	no

Watches

Name	Title	Kind	Defaults	Checked by default
`cpu-high`	Processor saturated	above a threshold, on `cpu-busy`	warning above 80 %, critical above 90 %, for 3 runs	yes
`memory-high`	Memory saturated	above a threshold, on `memory-used-percent`	warning above 80 %, critical above 88 %, for 3 runs	yes
`sessions-unusual`	Unusual number of sessions	off its habit, on `sessions`	normal sensitivity, never under 1000 sessions	no
`session-rate-high`	Session rate high	above a threshold, on `session-rate`	no threshold: the rate a FortiGate takes depends on its model	no

Limits

On a FortiGate split into virtual domains (VDOM), these values are those of the whole device.
On a cluster, each member answers for itself: one probe per member, by its own management address.
The conserve mode thresholds can be changed on the FortiGate (config system global, memory-use-threshold-red): set "Memory saturated" to match.