FortiSIEM external SNMP Server

[adem_netsys]

Hi guys,

I want to pull performance data from Super for this I tried snmpv1/2 and v3 versions. The first one is that I got credential and discovery success in the config I made with rocommunity, but I can't see anything except ping stat in the performance monitor. When trying v3, I keep getting invalid character error in GUI credential, but I confirmed that there is no such character. It can't be able to pull all the data with Super v1/2, right?

Has anyone encountered this stiuation before?

Thank you

[adem_netsys]

Do you have any idea?

[Secusaurus]

Hi @adem_netsys,

I am not sure if I understand the question correctly.

Are you talking from a third-party device via SNMP to the FSM Supervisor? Or are you trying to get SNMP-information of a third-party device to be collected by the FSM?

What is the device vendor/type which should talk to FSM / FSM should be talking to?

Is the invalid character error already while doing the configuration or just a result of testing the credentials?

Best,

Christian

[adem_netsys]

Hi @Secusaurus

Actually, I'm talking about the super itself. I want to get the performance data of the super and write performance rules based on it. I haven't made any progress on this.

[Secusaurus]

so you try to connect the supervisor to itself?

The performance/health should already be monitored via internal phoenix logs - what information are you missing at the moment?

The issue probably is that there is no OID-assignment defined for SNMP queries against FSM components. Therefore, it won't install any monitors. You might need to write a custom OID-definition to get the information via SNMP then.

Best,

Christian

[adem_netsys]

Yes, I defined the credentials accordingly using super's own snmp information and passed the credential, discovery test successfully, but data such as cpu, disc and memory do not fall into the performance monitor. My main goal here is to be able to use existing or custom rules for cpu, memory and disc on super. For example, if the disc goes over 75%, generate a notification.

[Secusaurus]

Just use the already existing phoenix log for that. Have a look at the recent internal logs of your supervisor, they should include event types like "PH_DEV_MON_VM_DISK_UTIL" and "PH_DEV_MON_VM_CPU_UTIL"

//EDIT: I just noticed that we also include the hypervisor on which our FSM runs in the monitoring. It might be possible that the mentioned events here don't come from phoenix directly but from the hypervisor logs. But you should have phoenix logs for that as well, since the health status view also is a result of logs //

Best,

Christian

[adem_netsys]

Device health comes empty inside, I think the reason for this is not SNMP configuration because I received the interface after snmp and saw it in device health, but I could not get the others.

Event Type = ‘PH_DEV_MON_SYS_CPU_UTIL’ and DISK
comes empty.