Technical Tip: How to configure email alerts for device configuration, policy package changes, and status updates on FortiManager
Description
This article describes how to configure an event handler that sends email notifications whenever configuration changes or policy package status changes occur on FortiManager.
Scope
FortiManager on-premises.
Solution
On a FortiManager running firmware versions prior to v7.4.0:
- Enable FortiAnalyzer Features.
Email notifications rely on event handlers, which are part of the FortiAnalyzer feature set. This feature must be enabled first in FortiManager.
It can be enabled from the GUI under Dashboard -> System Information -> FortiAnalyzer Features.
Alternatively, it can be enabled from the CLI with the following commands:
config system global
set faz-status enable
end
- Under System Settings -> Event logs, events will be seen when config status or policy status is changed.
Both events will be logged under separate log types. For policy changes, refer to the following image:
For configuration changes, refer to the following image:
- Configure the email server: Alerts will be sent using this email server.
Configure it under System Settings -> Mail Server.
- Create an event handler for both conditions.
The event handler for policy status changes can be configured as shown below:
- When there is an event log generated for the status changes and when it matches the events configured in the event handler, there is an email sent with details about the event to the email addresses configured in the notification section.
In a FortiMnager running firmware version v7.4.0 and above (follow steps 1 to 3 from the previous setup, then proceed with the following):
- Clone the Default Event Handler:
- Modify the Event Handler Rules: Edit the cloned handler then either modify the existing rule or delete it and create a new one.
- Configure the rule as follows: Select Refine Your Logs, select any one of the filters, then remove any existing log filters. Under Log Filter by Text, enter 'subtype=scply'.
Explanation:
- scply: Records policy package status changes.
- objcfg: Records configuration changes.
Example of event logs with the subtype 'scply':
Example of event logs with the subtype 'objcfg':
- Configure the notification profile:
After saving the rule, return to the Basic Event Handler settings and select a Notification Profile that will be used with the configured mail server. If no notification profile exists, use the (+) button to create a new one:
Select Send Alert Email and fill in the required email details, then save the profile:
Apply it to the event handler and save the handler settings.
At this point, the event handler is configured so email alerts will be sent whenever:
- A configuration change occurs in the device database.
- A configuration change occurs in the policy package database.
- A configuration or policy package status change is recorded.