riskersen / monitoring Goto Github PK

Not sure if this isn't standard behaviour, but as there is an exception for HP printers in the code of check_printer it looks like there are some printer manufacturers that don't return anything when there is no alert. We have Samsung and Sharp printers here, and the alert list is empty for both. I suggest an additional parameter for the alerts command, that allows the list to be empty, so you can allow this behaviour in your check command or service definition.

Hi

Loving your printer monitoring for all printers but our couple of monochrome Ricoh printers are not working.

Setup

define command {
    command_name check_ricoh_bw
    command_line /usr/lib/nagios/plugins/check_printer '$HOSTADDRESS$' public v2c toner_ricoh_monochrome 1 .2 .1
}

define service{
        use                     generic-service        
        hostgroup_name          ricohbw         
        service_description     Toner Black Status            
        check_command           check_ricoh_bw       
        normal_check_interval   10      
        retry_check_interval    1       
        notification_interval   1440    
        }

Status Retuned : UNKNOWN -

Have i got something wrong or is there a bug..

    It seems like this check gives false positive with FortiOS 7.0.6

Anyone experienced this? Any way to verifiy?

Originally posted by @HOSTED-POWER in #63 (comment)

The second line should be
"# nagios: -epn"

But you have
"# nagios -epn"

This patch will correct a mistake in commit 954c7ec, which will lead to perfdata not being recognized by pnp4nagios 0.6.

According to the Documentation, the UOM needs to be applied to $value instead of the end of the string:

source

122c122
<                       $str .= ";";
---
>                       $str .= "c;";
135c135
<                       echo $str."c ";
---
>                       echo $str." ";

Hello,
Until version 1.6.0 of the script, there was a request to get the value of the OID ".1.3.6.1.2.1.1.1.0".
This was then displayed in the status detail.
A user asks us to resume this functionality.

Hi Oli,
I am wondering, if your check_dwd plugin is still working. I always get "no warnings" but there are ones:

./check_dwd Bayern
OK: keine Warnungen für Bayern auf http://www.dwd.de/DE/wetter/warnungen/warntabelle_node.html gefunden
./check_dwd 'Kreis und Stadt Passau'
OK: keine Warnungen für Kreis und Stadt Passau auf http://www.dwd.de/DE/wetter/warnungen/warntabelle_node.html gefunden

Regards,
Marcus

Hi, thank you for your plugin ;) SNMP v3 support is planned ?

Tried to see the output of help but didn't work. According to the source code this should be the "-?" or "--help" option.

# ./check_fortigate.pl -?; date
Wed Jan 13 09:26:40 CET 2016

# ./check_fortigate.pl --help; date
Wed Jan 13 09:30:08 CET 2016

Perl version:

 # perl -v | grep "This is"
This is perl 5, version 18, subversion 2 (v5.18.2) built for x86_64-linux-gnu-thread-multi

This is on Ubuntu 14.04 LTS.

Thanks for checking and for this plugin.

Hi all, I would like to use the Fortigate script for my Fortimail as well. Currently I have problems to monitor the CPU and memory. I get the error
No response from remote host "" during discovery.

With kind regards :)

Hi Oli,

just tested the latest version 1.7.3.
On execution I got many notices like;
given is experimental at ./check_forti_new line 207. when is experimental at ./check_forti_new line 208. given is experimental at ./check_forti_new line 209. when is experimental at ./check_forti_new line 210. when is experimental at ./check_forti_new line 211. when is experimental at ./check_forti_new line 212. when is experimental at ./check_forti_new line 213. when is experimental at ./check_forti_new line 216. given is experimental at ./check_forti_new line 217. when is experimental at ./check_forti_new line 218. when is experimental at ./check_forti_new line 219. when is experimental at ./check_forti_new line 220. when is experimental at ./check_forti_new line 221. when is experimental at ./check_forti_new line 222. when is experimental at ./check_forti_new line 223. given is experimental at ./check_forti_new line 227. when is experimental at ./check_forti_new line 228. when is experimental at ./check_forti_new line 229. when is experimental at ./check_forti_new line 230. when is experimental at ./check_forti_new line 231. when is experimental at ./check_forti_new line 232. when is experimental at ./check_forti_new line 233. when is experimental at ./check_forti_new line 234. when is experimental at ./check_forti_new line 235.

Furthermore I got a critical error:
CRITICAL: Error writing on /var/spool/nagios/ramdisk/FortiSerial directory, permission denied

This error is correct, because I don't have this directory. Since I am using Icinga2 with pnp4nagios, I just have the folder:
`/var/spool: tree icinga2/
icinga2/
├── perfdata
└── tmp
├── host-perfdata
└── service-perfdata

/var/spool: tree pnp4nagios/
pnp4nagios/
├── nagios
└── npcd
`

Hi,

When snmp request is empty, script exit is not clean.

$ check_fortigate.pl -H 10.x.y.z -C public $HOME/FortiSerial -T VPN -M 0
Can't use an undefined value as a HASH reference at check_fortigate.pl line 326.

# Get just the top level tunnel data

=> my %tunnels = %{get_snmp_table($session, $oid_ipsectuntableroot . $oidf_tunndx)};

$ snmpwalk -v1 --cpublic 10.x.y.z .1.3.6.1.4.1.12356.101.12.2.2
$

Tested on Fortigate 800C-CL (5.2.2)

Currently the plugin uses iso.3.6.1.2.1.1.1.0 as systemname lookup:

my $oid_unitdesc = ".1.3.6.1.2.1.1.1.0"; # Location of Fortinet device description... (String)

However this is a problem because on my Fortigate 300D this value is the same for both master and slave firewalls. This is the value which is defined in Config -> SNMP (Description). So this is rather a cluster description.

# snmpwalk -v 2c -c monitoring master 1.3.6.1.2.1.1.1.0
iso.3.6.1.2.1.1.1.0 = STRING: "fw001"
# snmpwalk -v 2c -c monitoring slave 1.3.6.1.2.1.1.1.0
iso.3.6.1.2.1.1.1.0 = STRING: "fw001"

When I change the description in the SNMP config, the value changes for both master and slave firewalls.

To use the correct hostname, rather use 1.3.6.1.2.1.1.5.0 which is the FQDN and works correctly:

# snmpwalk -v 2c -c monitoring master 1.3.6.1.2.1.1.5.0
iso.3.6.1.2.1.1.5.0 = STRING: "fw001.example.local"

# snmpwalk -v 2c -c monitoring slave 1.3.6.1.2.1.1.5.0
iso.3.6.1.2.1.1.5.0 = STRING: "fw002.example.local"

I have wrong memory usage on: Fortigate 900D, 60F, 60E (6.4.5). It does not match memory usage returned by dashboard widget.

I`ve checked SNMP OIDS, and it looks like .1.3.6.1.4.1.12356.101.13.2.1.1.4 is being used. This oid is decribed as "Memory usage of the specified cluster member (percentage)" and it returns multiple values. But non of them match "usage" returned by dashboard widget.

So I`ve started to dig for details:
root@x:/etc/icinga2/bin# snmpwalk [censored] .1.3.6.1.4.1.12356.101.13.2.1.1.4
iso.3.6.1.4.1.12356.101.13.2.1.1.4.1 = Gauge32: 56 /<- master/
iso.3.6.1.4.1.12356.101.13.2.1.1.4.2 = Gauge32: 28

System output:
Memory: 16449968k total, 5812716k used (35.3%), 7223252k free (43.9%), 3414000k freeable (20.8%)

So it looks like that .1.3.6.1.4.1.12356.101.13.2.1.1.4 returns total used memory including freeable memory (system buffers/cache I guess). 35+21=56

Further, I have found OID 12356.101.4.1.4.0, with returns valid value. But it does not work per cluster member.

root@x:/etc/icinga2/bin# snmpwalk [censored] 10.10.0.1 1.3.6.1.4.1.12356.101.4.1.4.0
iso.3.6.1.4.1.12356.101.4.1.4.0 = Gauge32: 35

Maybe we should add second check for single unit? Im using this check to not to hit "conserve mode" so Im interested only in not freeable memory usage.

What do you think? Please verify.

Hi,
I tried the check_fortigate.pl to check VPN sessions. but I don't get any status. The result is only the cluster status.

./check_fortigate.pl -H HOSTIP -v 3 -U USER -A PASSW -a sha -x aes128 -X PASSW -T vpn -V both -M 1
OK: [email protected],build5785,210520 (GA) (Master: FG201FTXXXXXXXXX, Slave: FG201FTXXXXXXX): HA (Active/Passive) is active, Sync-State: Synchronized

CPU and MEM Check is working btw.

Hi,
sorry for the delay.
i have try the new script but i have a mistake

./check_fortigate.pl -H A.B.C.D -C [COMUNITY] -p [FORTISERIAL_PATH] -T mem-sys
UNKNOWN: OID .1.3.6.1.4.1.12356.101.4.1.4.0.1 does not exist

The script add the .1 for the master and .2 for the slave, but this OID doesn't exist

Originally posted by @VincentROLLAND in #59 (comment)

I was quite happy to find the -B parameter because this will clean up our nagios view. But i fail by adding multiple phase 2 names (and some of them contain spaces) for the exclusion. Can you assist me with this problem?
I have tried various versions of
./check_fortigate.pl -H $HOSTADDRESS$ -C $COMMUNITY$ -T vpn -V both -B "Europe SSLVPN" -B "Asia SSLVPN"
Best regards
Markus

Hello, I would now also like to query the licences of my firewalls and am also encountering an error. I use the following query and get the following output:

check_fortigate.pl -H IP-ADRESSE -T license
OK: ..........(GA) HA: Standalone

I unfortunately cannot understand this problem

Hello,

Since the FortiOS 6.2.3, the script check_fortigate.pl doesn't work properly to monitor IPSec tunnels

The script only show 9 tunnels (Phase 2) but I have 102 tunnels on this cluster.

The script make a warning or a critical alerts for tunnels but none of the designated tunnel is really down.

snmpwalk -v2c -c <community> <host> .1.3.6.1.4.1.12356.101.12.2.2.1.20 | wc -l
102

For example :

./check_fortigate.pl -C <community> -H <host> -T VPN -V ipsec -M 0 
OK: FGXXXXX (Master: FG800DXXXXXXXXXX): IPSEC Tunnels: Configured/Active: 9/8 |'ActiveSSL-VPN'=0 'ActiveIPSEC'=8

./check_fortigate.pl -C <community> -H <host> -T VPN -V ipsec -M 0       
OK: FGXXXXX (Master: FG800DXXXXXXXXXX): IPSEC Tunnels: Configured/Active: 9/6 |'ActiveSSL-VPN'=0 'ActiveIPSEC'=6

./check_fortigate.pl -C <community> -H <host> -T VPN -V ipsec -M 0
OK: FGXXXXX (Master: FG800DXXXXXXXXXX): IPSEC Tunnels: Configured/Active: 9/9 |'ActiveSSL-VPN'=0 'ActiveIPSEC'=9

./check_fortigate.pl -C <community> -H <host> -T VPN -V ipsec -M 0
OK: FGXXXXX (Master: FG800DXXXXXXXXXX): IPSEC Tunnels: Configured/Active: 9/8 |'ActiveSSL-VPN'=0 'ActiveIPSEC'=8

./check_fortigate.pl -C <community> -H <host> -T VPN -V ipsec -M 0
OK: FGXXXXX (Master: FG800DXXXXXXXXXX): IPSEC Tunnels: Configured/Active: 9/9 |'ActiveSSL-VPN'=0 'ActiveIPSEC'=9

./check_fortigate.pl -C <community> -H <host> -T VPN -V ipsec -M 0
OK: FGXXXXX (Master: FG800DXXXXXXXXXX): IPSEC Tunnels: Configured/Active: 9/8 |'ActiveSSL-VPN'=0 'ActiveIPSEC'=8

./check_fortigate.pl -C <community> -H <host> -T VPN -V ipsec -M 0
OK: FGXXXXX (Master: FG800DXXXXXXXXXX): IPSEC Tunnels: Configured/Active: 9/7 |'ActiveSSL-VPN'=0 'ActiveIPSEC'=7

./check_fortigate.pl -C <community> -H <host> -T VPN -V ipsec -M 0
OK: FGXXXXX (Master: FG800DXXXXXXXXXX): IPSEC Tunnels: Configured/Active: 9/7 |'ActiveSSL-VPN'=0 'ActiveIPSEC'=7

./check_fortigate.pl -C <community> -H <host> -T VPN -V ipsec -M 0
OK: FGXXXXX (Master: FG800DXXXXXXXXXX): IPSEC Tunnels: Configured/Active: 9/6 |'ActiveSSL-VPN'=0 'ActiveIPSEC'=6

What do you need to debug this issue ?

Thanks

add option to ex/include VPNs

The APC SMART-UPS 3000 RM with Firmware from around 1998 does support SNMP v1 only. Would be nice if the Script supports the "common" SNMP Version Parameter (like net.snmp).

Example:
check_ups_apc.pl -H FOO -v 1
Of cause its possible to change the net-snmp Paramerters in the Script:

my ($session, $error) = Net::SNMP->session(
#		-version	=> 2,
		-version	=> 1,

but then you change it from very ups.

AFAIK the script does SNMP v2 by default or v3 via parameter.

check_printer outputs an internal error when running the alerts command since php v5.2.0.

Looks like they changed how snmp[|2|3]_walk works in php5.2 and up: it doesn't return an associative array with oids as keys. There are new functions called snmp2_**real_**walk, that work like snmp2_walk did before.

When run, warings are printed about the usage of the experimental "given" and "when".
Typical output would include:
given is experimental at ./check_ups_apc-original.pl line 381.
and
when is experimental at ./check_ups_apc-original.pl line 382.

The given / when feature is (sometimes) using "smartmatch" which is almost certainly either going to change or go away in the future.
Replacement with other constructs seems to be the best solution instead of supressing these warnings.

Hi,
using the last Version (2017-02-07) with command "alerts" result always in an "UNKNOWN - Internal error".
However using the Version from 2014-07-23 will work with the same call very well.

Using Ubuntu 16.04.2 LTS with PHP 7.0.
Call:: ./check_printer.php 10.1.1.123 public 2 alerts

Any suggestions, how I can get more Informations or what is here the problem?
Thanx.

with multiple vdom this code calculate only the vpn on first,
example:
SNMPv2-SMI::enterprises.12356.101.12.2.3.1.2.1 = Gauge32: 0
SNMPv2-SMI::enterprises.12356.101.12.2.3.1.2.2 = Gauge32: 0
SNMPv2-SMI::enterprises.12356.101.12.2.3.1.2.3 = Gauge32: 2

with this change working fine for me:

# Unless specifically requesting IPSec checks only, do an SSL connection check
  if ($vpnmode ne "ipsec"){
	my $oid_ActiveSSL         = ".1.3.6.1.4.1.12356.101.12.2.3.1.2.";  # Location of Fortinet firewall SSL VPN Tunnel connection count
	my $oid_ActiveSSLTunnel   = ".1.3.6.1.4.1.12356.101.12.2.3.1.6.";  # Location of Fortinet firewall SSL VPN Tunnel connection count
	my $oidf_fgVdNumber       = ".1.3.6.1.4.1.12356.101.3.1.1.0";      # Vdom number
	$ActiveVdom = get_snmp_value($session, $oidf_fgVdNumber);
	for (my $i = 1; $i < $ActiveVdom+1; $i++) {
		$ActiveSSL += get_snmp_value($session, $oid_ActiveSSL.$i);
		$ActiveSSLTunnel += get_snmp_value($session, $oid_ActiveSSLTunnel.$i);
	}
  }

It seems the "-T cluster" check is not working correctly when the check is launched on the slave.
Output is:

./check_fortigate.pl -H slaveip -S AAAAAAAAAAAAAAAA -T cluster 
CRITICAL: fw002 (Master: BBBBBBBBBBBBBBBB, Slave: AAAAAAAAAAAAAAAA): HA (Active/Passive) is active, preferred master AAAAAAAAAAAAAAAA is not master!, Sync-State: Not Synchronized

The plugin thinks that serial BBBBBBBBBBBBBBBB should be master. But in the SNMP output it is shown that AAAAAAAAAAAAAAAA is master:

# snmpwalk -v 2c -c public slave 1.3.6.1.4.1.12356.101.13.2
iso.3.6.1.4.1.12356.101.13.2.1.1.1.1 = INTEGER: 1
iso.3.6.1.4.1.12356.101.13.2.1.1.1.2 = INTEGER: 2
iso.3.6.1.4.1.12356.101.13.2.1.1.2.1 = STRING: "BBBBBBBBBBBBBBBB"
iso.3.6.1.4.1.12356.101.13.2.1.1.2.2 = STRING: "AAAAAAAAAAAAAAAA"
iso.3.6.1.4.1.12356.101.13.2.1.1.3.1 = Gauge32: 0
iso.3.6.1.4.1.12356.101.13.2.1.1.3.2 = Gauge32: 0
iso.3.6.1.4.1.12356.101.13.2.1.1.4.1 = Gauge32: 29
iso.3.6.1.4.1.12356.101.13.2.1.1.4.2 = Gauge32: 30
iso.3.6.1.4.1.12356.101.13.2.1.1.5.1 = Gauge32: 6
iso.3.6.1.4.1.12356.101.13.2.1.1.5.2 = Gauge32: 7
iso.3.6.1.4.1.12356.101.13.2.1.1.6.1 = Gauge32: 8
iso.3.6.1.4.1.12356.101.13.2.1.1.6.2 = Gauge32: 11
iso.3.6.1.4.1.12356.101.13.2.1.1.7.1 = Counter32: 33634
iso.3.6.1.4.1.12356.101.13.2.1.1.7.2 = Counter32: 637158
iso.3.6.1.4.1.12356.101.13.2.1.1.8.1 = Counter32: 5748710
iso.3.6.1.4.1.12356.101.13.2.1.1.8.2 = Counter32: 152509278
iso.3.6.1.4.1.12356.101.13.2.1.1.9.1 = Counter32: 0
iso.3.6.1.4.1.12356.101.13.2.1.1.9.2 = Counter32: 0
iso.3.6.1.4.1.12356.101.13.2.1.1.10.1 = Counter32: 0
iso.3.6.1.4.1.12356.101.13.2.1.1.10.2 = Counter32: 0
iso.3.6.1.4.1.12356.101.13.2.1.1.11.1 = STRING: "fw002"
iso.3.6.1.4.1.12356.101.13.2.1.1.11.2 = STRING: "fw001"
iso.3.6.1.4.1.12356.101.13.2.1.1.12.1 = INTEGER: 1
iso.3.6.1.4.1.12356.101.13.2.1.1.12.2 = INTEGER: 0
iso.3.6.1.4.1.12356.101.13.2.1.1.13.1 = ""
iso.3.6.1.4.1.12356.101.13.2.1.1.13.2 = ""
iso.3.6.1.4.1.12356.101.13.2.1.1.14.1 = ""
iso.3.6.1.4.1.12356.101.13.2.1.1.14.2 = ""
iso.3.6.1.4.1.12356.101.13.2.1.1.15.1 = STRING: "A061A044BA6725817CD726C0C38529A2"
iso.3.6.1.4.1.12356.101.13.2.1.1.15.2 = STRING: "A061A044BA6725817CD726C0C38529A2"
iso.3.6.1.4.1.12356.101.13.2.1.1.16.1 = ""
iso.3.6.1.4.1.12356.101.13.2.1.1.16.2 = STRING: "AAAAAAAAAAAAAAAA"

I assume the plugin simply takes the first found entry (.1) and considers it to be master. The actual master serial ID is stored in .1.3.6.1.4.1.12356.101.13.2.1.1.16.2 (fgHaStatsMasterSerial). So the plugin should take this value.

However of what I'm not sure is why the value of 1.3.6.1.4.1.12356.101.13.2.1.1.12.2 is showing 0 (Not Synchronized). Any idea? Or is this normal that from point of view of the slave the master (fw001) is not in sync?

Running the check without specifying battery thresholds will return a WARNING eventhough the batery temp is normal.
Typical output (mind the absence of the warning threshold in the perf data):
WARNING - Smart-UPS X 3000 - BATTERY CAPACITY 100% - STATUS NORMAL - OUTPUT LOAD 11% - WARN BATT TEMP 22 C - 144 MINUTES REMAINING FIRMWARE: UPS 06.6 (ID23) - MANUFACTURE DATE: 01/01/2018 - SERIAL: AB1234567890|'load'=11%;70;80;; 'temp'=22;;33;; 'remaining_sec'=8640s;900;300;0;

I don't think it's currently explicitly supported, but I would expect a conserve mode check. It's pretty bad when entering conserve mode and we should know immediately.

https://forum.fortinet.com/tm.aspx?m=112759

(Not sure if the OID over there is right)

Thank you Oliver for this ups check script, work like a charm. I was wondering if you have check_ups_apc.pl that supports SNMP ver 3 ?

Hi,

On a Fortigate 100D (firmare 5.2.7), I have the following error when trying to check VPN :

./check_fortigate.pl -H 192.168.x.x -C public -T vpn -V both -M 1
UNKNOWN: session get table failed for .1.3.6.1.4.1.12356.101.12.2.2.1.1

And effectively, this OID doesn't exist.

typo: wich is spelled which

I am trying to get ADVPN and other IPSEC tunnels monitored that are in Acive/Passive mode
IS there a way to exclude some interfaces and link the active/passive and have just one display as up?

On some HP printers the alert OID is missing when there are no alerts.

Possible solution:

• request sysDescr
• if match for HP printer then ignore missing OID and return OK

Hi everyone,

I get this error message:
"Illegal division by zero at /home/dgadm/check_fortigate.pl line 363."

while checking the type disk on one of our 600E (v 6.2.4). With my pathetic Perl knowledge, I've tried to print out the values for $value_usage and $value_cap and I get always a zero. Same with a snmpwalk on the OIDs:
SNMPv2-SMI::enterprises.12356.101.4.1.7.0 = Gauge32: 0
SNMPv2-SMI::enterprises.12356.101.4.1.6.0 = Gauge32: 0
This explains the error message. But I wonder why I it's always zero, the 600E should have SSDs.

Other types like ses, mem and hw are working. CPU gives me 0% though, but at least not an error :)

Any ideas?

Greetings

René

The SNMP values for Brother printers seem to return negative values for MAX and CUR. This leads to the fact, that no reporting on ink or toner levels can work. It is always CRITICAL as always < 0.

check-license command says UNKNOWN COMMAND. It looks like this isn't finished? Should it work?

It was not found in the command_table, but even if I added it ('check-license' => &check_license,), it still says UNKNOWN COMMAND. Any help is appreciated.

Hi Oli,
thanks again for the great plugins and steady improvements.

Do you also have a Plugin for FortiADC Version 4.6 300D?
We are testing this device right now and if we decide to use it, we also want to monitor it.
If you need some MIBs, just tell me. :)

Kind regards,

Marcus

I'm wondering if it is possible to track the interface link state of a FortiGate (e.g. 100F)? I wasn't able to find a hint in the argument list...

Especially I'm interested to monitor the WAN-Interface. For example: In a Active/Passive cluster (WAN interfaces are monitored by HA), where the interface link state of WAN goes down for the slave (e.g. the ISP device / cable goes down). There wouldn't be any notification within icinga2. Suppose you haven't noticed for several days that the WAN interface is down on slave. After some the days the WAN interface of master goes also down. Now you are completely offline because WAN is down on both devices.
(In case the interfaces goes first down on master, I will get the notification with icinga2 because the master changes to the passive device).

For this I want to monitor the link state of WAN interfaces with icinga2.

When running

check_fortigate.pl ... -T firmware -w 200000 -c 190000

The expected behavior is:

• Warn if firmware < 200000
• Critical if firmware < 190000.

The actual behavior is somewhat different:

• Warn if firmware != 200000
• No critical possible with a warn threshold specified, no matter which value is higher.

Hi Oliver,
first of all thanks a lot for updating the script. I can use it now for all my fortigates :)
Are you interested in implement fortmail checks too?
I'm not a coder, so I cannot do it myself, but I found an article about the OIDs which have to be checked:
https://yousysad.wordpress.com/2012/06/21/fortimail-by-snmp/

Greetings,

Marcus

Hi,

All checks are working properly, except for the license check it seems weird I cannot have any error:

./check_fortigate.pl -H x.x.x.x -C snmp4all -T license -c 5000 -w 5000
OK: ...

./check_fortigate.pl -H x.x.x.x -C snmp4all -T license -c 5000000-w 5000000
OK: ...

Whatever I fill in for value, it keeps giving ok ...