FortiGate automation - Send email or telegram or WhatsApp notifications.

[Marcos_FDS1012]

Hello,

I'm trying to create a notification when my internet link is down to send a message by e-mail, but I'm getting 3 e-mails with DOWN and UP status, would you have a tutorial I can see where I'm going wrong?

Another thing, would it be possible to send this by telegram or WhatsApp? I can't do it through teams because Microsoft is giving me an error in the apps.

I'll send a printout of my settings

[AEK · Accepted solution]

Hi Marcos

I don't think you can send Telegram or WhatsApp message from FG, but I guess you can do it from your monitoring server, as it receives the related syslog message or snmp trap from FG.

[AEK · Accepted solution]

You may use the "status" field in the trigger to check if it matches the right value (I don't know what is the value to match).

https://docs.fortinet.com/document/fortiproxy/7.4.4/log-message-reference/20090/20090-log-id-intf-li...

Didn't test it but I think it should work.

[AEK · Accepted solution]

Then you may keep 20099. It also has "status" field.

https://docs.fortinet.com/document/fortigate/7.4.4/fortios-log-message-reference/20099/20099-log-id-...

As per my research, in your case the "status" field must match the string "DOWN" (in capital letters).

[Marcos_FDS1012 · Accepted solution]

Of course, as I said, I receive 3 e-mails, two down and one up.

[Marcos_FDS1012]

When I do this I don't get an e-mail, if I take it off I do

[AEK · Accepted solution]

So can you try "up->down" instead, like suggested by dbhavsar below?

[Marcos_FDS1012]

I did it too but it gave me an error

[AEK]

Please try this:

• Field name "status" not "Status"
• Value: "DOWN"

[Marcos_FDS1012]

Follow

[dbhavsar]

Good day @Marcos_FDS1012 ,

- In your first screen shot you can filter the field by using following value:

Field: Config Attribute  > Value: status[up->down]

- after that you will only receive emails if the status changes from UP to DOWN.

[Marcos_FDS1012]

Hello,

you say so? I use Event 20099 or 20090