Below is a screenshot of the " alert" I built in the FAZ. I' m running MR7 Patch 2 on it. I removed the IP addresses and names from the screenshot, but you get the idea.
1.) Create new alert
2.) Give it a name (my example is: CoLo Tunnel Down)
3.) Select the fortigate you want to use (my example is for all fortigates)
4.) Select " Event Log" and " Notification" as your trigger. I just dug through my event log until I found an entry that the tunnel was down and cut the info out of the event log
5.) Under " Log Filters" select " Generic Text" and paste in the log entry from #4 above. My example says " IPsec Tunnel to <ip adress and port here> is down"
6.) select your " Threshold" . 1 event in 1/2 hour is the minimum so it triggers on any event that meets your tigger/filter from above.
7) set up the destination for your alert. mine are all whited out, but it' s pretty easy.
Then test away. I was able to test this during production hours and it works great. Post back and let us know how it went for you. I also set up the same alert with the generic text that says " IPsec Tunnel to <ip adress and port here> is up" to alert me when it comes back up.
