Description
The article describes how to configure email alerts for configuration and policy status changes on FortiManager.
Scope
FortiAnalyzer.
Solution
- Enable FortiAnalyzer feature: Event handler is a FortiAnalyzer feature, thus needs to be enabled under System Settings -> Dashboard -> System Information.
- Under System Settings > Event logs, you will see events when the configuration status or policy status is changed.
Both events will be logged under separate log types.
For policy changes:
For configuration changes:
- Configure email server. Alerts will be sent using this email server. It is configured under System Settings -> Mail Server.
- Create an event handler for both conditions: Under Event Management -> Event Handler list -> Create new. Event handler for configuration status changes:
Event handler for policy status changes:
When there is an event log generated for the status changes and when it matches the events configured in the event handler, an email is sent with details about the event to the email addresses configured in the notification section.
Troubleshooting Event Generation Failure: The following commands on the FortiManager will provide more information regarding the SMTP client application.
For FortiManager/FortiAnalyzer v7.6 or above, perform a flow capture:
diagnose test application fazmaild ?
<Integer> Debug level (08).
diagnose debug application fazmaild 8
diagnose debug timestamp enable
diagnose debug enable
diagnose debug disable <- To stop it.
diagnose debug reset
diag test connection mailserver <mailserver> <source SMTP address> <destination SMTP address>
