Stitch Action if the event is present for ammount of time

[Skytech1]

Hello Community,

Is there a way to create a stitch to perform an action if an event is preset for an ammount of time?

Example:

A fortiswitch port is disconnected...then I can grab that event and create a stitch to notify vía email when this happens..

But what if I want to send the email if the port is disconnected for 10 mins? not before, and of course if the port is connected before 10 mins then no action....is it possible?

Thanks

Andres

[DPadula]

Hi Skytech1,

I looked into the stitch logic and you can add a delay between actions but I could not find a way to add two triggers. If interface is down (log message interface down status) then after 10 min if NO log message interface UP then send an email.

If you think about it, a SNMP monitoring system can do that, generates an alert if interface is down and if the interface is up again the alert is cleared. So if you have a monitoring system in place would be much easier to use it for this task. 

[Skytech1]

Hi @DPadula 

Yes, with SNMP is achievable, the only drawback is that via SNMP you get all the interfaces status from every single port of the switch, then you have to make a lot of exclusions to handle that you want to receive notifications only for specific ports, that's why I was thinking about stitches because you can define triggers per specific port, that would be really cool if the FortiGate could handle that 

Thanks!

[DPadula]

Another idea, you can use a python script for example to check the interface status every 10 min, if on the next check the port is still down then an email can be generated.

It is not a elegant solution but it will work, the drawback is when the script has just checked the interfaces and let's say 30 second after an interface is down, so on the next check the script will mark the interface down for the first time. On the following check then the script will inform you via email, but the interface has been down already 29min.

Reducing the frequency between the script checks can improve the accuracy of the script but you will need to test different few scenarios to find the optimal time between accuracy and less script checks.