FORTINET-FORTIANALYZER-MIB

All MIBs › FORTINET-FORTIANALYZER-MIB

Organization: Fortinet Technologies, Inc.

Last Updated: 2009-09-21

Category: Domain: Network Management, Vendor: Fortinet

Description: Fortinet FortiAnalyzer MIB providing SNMP management objects for the FortiAnalyzer log aggregation and network security analytics appliance.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is FORTINET-FORTIANALYZER-MIB?

FORTINET-FORTIANALYZER-MIB is Fortinet's vendor-specific SNMP module for FortiAnalyzer, its centralized log-collection and security-analytics appliance used across the FortiGate ecosystem. It exposes system-level fault and event objects, RAID array status for the appliance's log storage disks, and detailed IP session tracking data for traffic passing through or logged by the device. It is explicitly geared toward monitoring hardware and software status, most notably faGenAlert general system alerts, faSystemEvent notifications, and faRAIDStatus/faRAIDDevIndex for tracking the health of individual disks in the log-storage RAID array, which is critical since a degraded array threatens log retention. It depends on standard SNMP notification conventions and the shared Fortinet enterprise MIB tree for its OID registration. It is typically deployed in security operations centers where FortiAnalyzer aggregates logs from many FortiGate firewalls and must itself be monitored for storage and event-processing health. Engineers can download the FORTINET-FORTIANALYZER-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in FORTINET-FORTIANALYZER-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Fortinet FortiAnalyzer log aggregation and analytics appliance

Monitoring Examples

An administrator polling faRAIDDevIndex and faRAIDStatus across the RAID device table can detect a failed or degraded disk in the FortiAnalyzer's log storage array before it causes log loss. The faIpSessTable (with faIpSessFromAddr, faIpSessToAddr, faIpSessFromPort, faIpSessToPort) lets an operator inspect active IP sessions being tracked, useful for confirming the appliance is correctly ingesting traffic from monitored devices. faTraps with faTrapPrefix/faTrapObject deliver asynchronous notifications, such as faGenAlert, when a system event like a RAID failure or disk-space threshold breach occurs.

What Can Be Monitored

RAID array/disk status
system event alerts (faGenAlert)
active IP session tracking
trap/notification activity
general appliance health

Imported Objects

From FORTINET-CORE-MIB

FnIndex
fnGenTrapMsg	OBJECT-TYPE
fnSysSerial	OBJECT-TYPE
fnTrapsPrefix	OBJECT-IDENTITY
fortinet	MODULE-IDENTITY

From INET-ADDRESS-MIB

InetPortNumber

From SNMPv2-CONF

MODULE-COMPLIANCE
NOTIFICATION-GROUP
OBJECT-GROUP

From SNMPv2-MIB

sysName

OBJECT-TYPE

From SNMPv2-SMI

Counter32
Gauge32
Integer32
IpAddress
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE

From SNMPv2-TC

DisplayString
TEXTUAL-CONVENTION

How to Use in IPNetwork Monitor

Example using faIpSessExp OID:

Select a Fortinet FortiAnalyzer log aggregation/analytics appliance as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type faIpSessExp into the Find box to locate it in the OID tree, selecting the specific row/instance you want to monitor since this is a table column, then select it and click OK. It reports the number of seconds remaining before the session expires (if idle). On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter32-type OID, Value bounds is the most useful condition here — trigger an alert if the value stays unexpectedly high or low relative to what you'd expect for this timer, since that can indicate a stuck or stale state. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
NTF faTrapLogRateThreshold	1.3.6.1.4.1.12356.100.1.3.0.1005			Indicates that the incoming log rate has exceeded the configured threshold.
NTF faTrapDataRateThreshold	1.3.6.1.4.1.12356.100.1.3.0.1006			Indicates that the incoming data rate has exceeded the configured threshold.
fnFortiAnalyzerMib	1.3.6.1.4.1.12356.102			MIB module for Fortinet FortiAnalyzer devices.
faTraps	1.3.6.1.4.1.12356.102.0
faTrapPrefix	1.3.6.1.4.1.12356.102.0.0
NTF faTrapSystemEvent	1.3.6.1.4.1.12356.102.0.0.1001			A system event occured. The specific type of event is indecated by the faSystemEvent parameter.
NTF faTrapRAIDStatusChange	1.3.6.1.4.1.12356.102.0.0.1002			Trap is sent when there is a change in the status of the RAID array, if present.
NTF faTrapGenAlert	1.3.6.1.4.1.12356.102.0.0.1003			Trap sent when FortiAnalyzer event parameter exceeds configured limit. Event description included in trap.
faTrapObject	1.3.6.1.4.1.12356.102.0.1
FAS faSystemEvent	1.3.6.1.4.1.12356.102.0.1.1	FaSysEventCode	accessible-for-notify	Type of system event that triggered notification.
FAR faRAIDStatus	1.3.6.1.4.1.12356.102.0.1.2	FaRAIDStatusCode	accessible-for-notify	New RAID state associated with a RAID status change event.
STR faRAIDDevIndex	1.3.6.1.4.1.12356.102.0.1.3	DisplayString	accessible-for-notify	Name/index of a RAID device relating to the event.
STR faGenAlert	1.3.6.1.4.1.12356.102.0.1.4	DisplayString	read-only	Detail of defined event alert sent from FortiAnalyzer
faModel	1.3.6.1.4.1.12356.102.1
faz100	1.3.6.1.4.1.12356.102.1.1000
faz100A	1.3.6.1.4.1.12356.102.1.1001
faz100B	1.3.6.1.4.1.12356.102.1.1002
faz100C	1.3.6.1.4.1.12356.102.1.1003
faz400	1.3.6.1.4.1.12356.102.1.4000
faz400B	1.3.6.1.4.1.12356.102.1.4002
faz800	1.3.6.1.4.1.12356.102.1.8000
faz800B	1.3.6.1.4.1.12356.102.1.8002
faz1000B	1.3.6.1.4.1.12356.102.1.10002
faz2000	1.3.6.1.4.1.12356.102.1.20000
faz2000A	1.3.6.1.4.1.12356.102.1.20001
faz4000	1.3.6.1.4.1.12356.102.1.40000
faz4000A	1.3.6.1.4.1.12356.102.1.40001
faInetProto	1.3.6.1.4.1.12356.102.2
faInetProtoInfo	1.3.6.1.4.1.12356.102.2.1
faInetProtoTables	1.3.6.1.4.1.12356.102.2.2
faIpSessTable	1.3.6.1.4.1.12356.102.2.2.1		not-accessible	Information on the IP sessions active on the device
faIpSessEntry	1.3.6.1.4.1.12356.102.2.2.1.1		not-accessible	Information on a specific session, including source and destination
FNI faIpSessIndex	1.3.6.1.4.1.12356.102.2.2.1.1.1	FnIndex	not-accessible	An index value that uniquely identifies an IP session within the faIpSessTable
FAS faIpSessProto	1.3.6.1.4.1.12356.102.2.2.1.1.2	FaSessProto	read-only	The protocol the session is using (IP, TCP, UDP, etc.)
IP faIpSessFromAddr	1.3.6.1.4.1.12356.102.2.2.1.1.3	IpAddress	read-only	Source IP address (IPv4 only) of the session
INE faIpSessFromPort	1.3.6.1.4.1.12356.102.2.2.1.1.4	InetPortNumber	read-only	Source port number (UDP and TCP only) of the session
IP faIpSessToAddr	1.3.6.1.4.1.12356.102.2.2.1.1.5	IpAddress	read-only	Destination IP address (IPv4 only) of the session
INE faIpSessToPort	1.3.6.1.4.1.12356.102.2.2.1.1.6	InetPortNumber	read-only	Destination Port number (UDP and TCP only) of the session
C32 faIpSessExpEx	1.3.6.1.4.1.12356.102.2.2.1.1.7	Counter32	read-only	Number of seconds remaining before the session expires (if idle)
fa300Compat	1.3.6.1.4.1.12356.102.99
faHwSensors	1.3.6.1.4.1.12356.102.99.1
I32 faHwSensorCount	1.3.6.1.4.1.12356.102.99.1.1	Integer32	read-only	The number of entries in faHwSensorTable
faHwSensorTable	1.3.6.1.4.1.12356.102.99.1.2		not-accessible	A list of device specific hardware sensors and values. Because different devices have different hardware sensor capabilities, this table may or may not contain any values.
faHwSensorEntry	1.3.6.1.4.1.12356.102.99.1.2.1		not-accessible	An entry containing the name, value, and alarm status of a given hardware sensor
FNI faHwSensorEntIndex	1.3.6.1.4.1.12356.102.99.1.2.1.1	FnIndex	not-accessible	A unique identifier within the faHwSensorTable
STR faHwSensorEntName	1.3.6.1.4.1.12356.102.99.1.2.1.2	DisplayString	read-only	A string identifying the sensor by name
STR faHwSensorEntValue	1.3.6.1.4.1.12356.102.99.1.2.1.3	DisplayString	read-only	A string representation of the value of the sensor. Because sensors can present data in different formats, string representation is most general format. Interpretation of the value (units of measure, for example) is dependent on the individual sensor.
INT faHwSensorEntAlarmStatus	1.3.6.1.4.1.12356.102.99.1.2.1.4	INTEGER	read-only	If the sensor has an alarm threshold and has exceeded it, this will indicate its status. Not all sensors have alarms.
fa300System	1.3.6.1.4.1.12356.102.99.2
STR fa300SysSerial	1.3.6.1.4.1.12356.102.99.2.1	DisplayString	read-only	Serial number of the device
STR fa300SysVersion	1.3.6.1.4.1.12356.102.99.2.2	DisplayString	read-only	Firmware version of the device
G32 fa300SysCpuUsage	1.3.6.1.4.1.12356.102.99.2.3	Gauge32	read-only	Current CPU usage (percentage)
G32 fa300SysMemUsage	1.3.6.1.4.1.12356.102.99.2.4	Gauge32	read-only	Current memory utilization (percentage)
G32 fa300SysSesCount	1.3.6.1.4.1.12356.102.99.2.5	Gauge32	read-only	Number of active sessions on the device
G32 fa300SysDiskCapacity	1.3.6.1.4.1.12356.102.99.2.6	Gauge32	read-only	Total hard disk capacity (MB), if disk is present
G32 fa300SysDiskUsage	1.3.6.1.4.1.12356.102.99.2.7	Gauge32	read-only	Current hard disk usage (MB), if disk is present
G32 fa300SysMemCapacity	1.3.6.1.4.1.12356.102.99.2.8	Gauge32	read-only	Total physical memory (RAM) installed (KB)
faMIBConformance	1.3.6.1.4.1.12356.102.100
faSystemComplianceGroup	1.3.6.1.4.1.12356.102.100.1			System related instrumentation
faTrapsComplianceGroup	1.3.6.1.4.1.12356.102.100.2			Event notifications
faSessionComplianceGroup	1.3.6.1.4.1.12356.102.100.3			Session related instrumentation
faMiscComplianceGroup	1.3.6.1.4.1.12356.102.100.4			Miscellanious instrumentation
faHwSensorComplianceGroup	1.3.6.1.4.1.12356.102.100.5			Hardware sensor related information
faNotificationObjectsComplianceGroup	1.3.6.1.4.1.12356.102.100.6			Object identifiers used in notifications
faMIBCompliance	1.3.6.1.4.1.12356.102.100.100			The compliance statement for the application MIB.
faObsoleteMIBCompliance	1.3.6.1.4.1.12356.102.100.101			The compliance statement of deprecated objects for the application MIB, they may still be used by older models.

RFC description

MIB module for Fortinet FortiAnalyzer devices including RAID status, system events, and session protocols.

Start monitoring Fortinet FortiAnalyzer log aggregation/analytics appliance with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download FORTINET-FORTIANALYZER-MIB