Check Point Next Generation Firewall by SNMP
Overview
This template is designed for the effortless deployment of Check Point Next Generation Firewall monitoring by Zabbix via SNMP and doesn't require any external scripts.
Requirements
Zabbix version: 7.0 and higher.
Tested versions
This template has been tested on:
- Check Point 4800 Appliance Next Generation Firewall
Configuration
Zabbix should be configured according to the instructions in the Templates out of the box section.
Setup
Refer to vendor documentation.
Macros used
Name | Description | Default |
---|---|---|
{$CPU.UTIL.CRIT} | Threshold of CPU utilization for the Warning trigger in %. |
90 |
{$LOAD_AVG_PER_CPU.MAX.WARN} | Load per CPU considered sustainable. Change if needed. |
1.5 |
{$ICMP_LOSS_WARN} | Threshold of ICMP packet loss for the Warning trigger in %. |
20 |
{$ICMP_RESPONSE_TIME_WARN} | Threshold of average ICMP response time for the Warning trigger in seconds. |
0.15 |
{$SNMP.TIMEOUT} | Time interval for the SNMP availability trigger. |
5m |
{$MEMORY.UTIL.MAX} | Warning threshold for the item "Physical memory: Memory utilization". |
90 |
{$FW.DROPPED.PACKETS.TH} | Used in Firewall discovery. |
0 |
{$DISK.FREE.MIN.CRIT} | Critical threshold of disk space usage. |
5G |
{$DISK.FREE.MIN.WARN} | Warning threshold of disk space usage. |
10G |
{$DISK.PUSED.MAX.WARN} | Disk utilization threshold for Warning trigger in %. |
80 |
{$DISK.PUSED.MAX.CRIT} | Disk utilization threshold for Critical trigger in %. |
90 |
{$DISK.NAME.MATCHES} | Used in Storage discovery. Can be overridden on the host or linked template level. |
.+ |
{$DISK.NAME.NOT_MATCHES} | Used in Storage discovery. Can be overridden on the host or linked template level. |
^(/dev|/sys|/run|/proc|.+/shm$) |
{$VPN.NAME.MATCHES} | Used in VPN discovery. Can be overridden on the host or linked template level. |
.* |
{$VPN.NAME.NOT_MATCHES} | Used in VPN discovery. Can be overridden on the host or linked template level. |
CHANGE_IF_NEEDED |
{$VPN.STATE.CONTROL} | Used in the "Tunnel down" trigger. Can be used with the interface name as context. |
1 |
{$NET.IF.ERRORS.WARN} | Threshold of error packet rate for the Warning trigger. Can be used with the interface name as context. |
2 |
{$NET.IF.UTIL.MAX} | Threshold of interface bandwidth utilization for the Warning trigger in %. Can be used with interface name as context. |
95 |
{$NET.IF.CONTROL} | Macro for the interface operational state for the "Link down" trigger. Can be used with the interface name as context. |
1 |
{$NET.IF.IFADMINSTATUS.MATCHES} | Used in Network interfaces discovery. Can be overridden on the host or linked template level. |
.* |
{$NET.IF.IFADMINSTATUS.NOT_MATCHES} | Used in Network interfaces discovery. Can be overridden on the host or linked template level. |
^2$ |
{$NET.IF.IFDESCR.MATCHES} | Used in Network interfaces discovery. Can be overridden on the host or linked template level. |
.* |
{$NET.IF.IFDESCR.NOT_MATCHES} | Used in Network interfaces discovery. Can be overridden on the host or linked template level. |
CHANGE_IF_NEEDED |
{$NET.IF.IFNAME.MATCHES} | Used in Network interfaces discovery. Can be overridden on the host or linked template level. |
.* |
{$NET.IF.IFNAME.NOT_MATCHES} | Used in Network interfaces discovery. Can be overridden on the host or linked template level. |
CHANGE_IF_NEEDED |
{$NET.IF.IFOPERSTATUS.MATCHES} | Used in Network interfaces discovery. Can be overridden on the host or linked template level. |
.* |
{$NET.IF.IFOPERSTATUS.NOT_MATCHES} | Used in Network interfaces discovery. Can be overridden on the host or linked template level. |
^6$ |
{$NET.IF.IFTYPE.MATCHES} | Used in Network interfaces discovery. Can be overridden on the host or linked template level. |
.* |
{$NET.IF.IFTYPE.NOT_MATCHES} | Used in Network interfaces discovery. Can be overridden on the host or linked template level. |
CHANGE_IF_NEEDED |
{$NET.IF.IFALIAS.MATCHES} | Used in Network interfaces discovery. Can be overridden on the host or linked template level. |
.* |
{$NET.IF.IFALIAS.NOT_MATCHES} | Used in Network interfaces discovery. Can be overridden on the host or linked template level. |
CHANGE_IF_NEEDED |
{$TEMP.NAME.MATCHES} | Used in Temperature discovery. Can be overridden on the host or linked template level. |
.* |
{$TEMP.NAME.NOT_MATCHES} | Used in Temperature discovery. Can be overridden on the host or linked template level. |
CHANGE_IF_NEEDED |
{$TEMP.VALUE.LOW} | Used in Temperature discovery. Can be overridden on the host or linked template level. |
5 |
{$TEMP.VALUE.CRIT} | Used in Temperature discovery. Can be overridden on the host or linked template level. |
75 |
{$TEMP.VALUE.WARN} | Used in Temperature discovery. Can be overridden on the host or linked template level. |
65 |
{$VOLT.NAME.MATCHES} | Used in Voltage discovery. Can be overridden on the host or linked template level. |
.* |
{$VOLT.NAME.NOT_MATCHES} | Used in Voltage discovery. Can be overridden on the host or linked template level. |
CHANGE_IF_NEEDED |
{$SW.NAME.MATCHES} | Used in Software blade discovery. Can be overridden on the host or linked template level. |
.* |
{$SW.NAME.NOT_MATCHES} | Used in Software blade discovery. Can be overridden on the host or linked template level. |
CHANGE_IF_NEEDED |
{$LICENSE.EXPIRY.WARN} | Number of days until the license expires. |
7 |
{$LICENSE.CONTROL} | Used in Software blade discovery. Can be overridden on the host or linked template level. |
1 |
Items
Name | Description | Type | Key and additional info |
---|---|---|---|
Appliance product name | MIB: CHECKPOINT-MIB Appliance product name. |
SNMP agent | system.hw.model Preprocessing
|
Appliance serial number | MIB: CHECKPOINT-MIB Appliance serial number. |
SNMP agent | system.hw.serialnumber Preprocessing
|
Appliance manufacturer | MIB: CHECKPOINT-MIB Appliance manufacturer. |
SNMP agent | system.hw.manufacturer Preprocessing
|
Remote Access users | MIB: CHECKPOINT-MIB Number of remote access users. |
SNMP agent | remote.users.number Preprocessing
|
System contact details | MIB: SNMPv2-MIB Name and contact information of the contact person for the node. If not provided, the value is a zero-length string. |
SNMP agent | system.contact Preprocessing
|
System description | MIB: SNMPv2-MIB Full name and version identification of the system's hardware type, software operating system, and networking software. |
SNMP agent | system.descr Preprocessing
|
System location | MIB: SNMPv2-MIB Physical location of the node (e.g., |
SNMP agent | system.location Preprocessing
|
System name | MIB: SNMPv2-MIB An administratively-assigned name for the node (the node's fully-qualified domain name). If not provided, the value is a zero-length string. |
SNMP agent | system.name Preprocessing
|
System object ID | MIB: SNMPv2-MIB The vendor's authoritative identification of the entity as part of the vendor's SMI enterprises subtree with the prefix 1.3.6.1.4.1 (e.g., a vendor with the identifier 1.3.6.1.4.1.4242 might assign a system object with the OID 1.3.6.1.4.1.4242.1.1). |
SNMP agent | system.objectid Preprocessing
|
System uptime | MIB: HOST-RESOURCES-V2-MIB Time since the network management portion of the system was last re-initialized. |
SNMP agent | system.uptime Preprocessing
|
Number of CPUs | MIB: CHECKPOINT-MIB Number of processors. |
SNMP agent | system.cpu.num Preprocessing
|
CPU utilization | MIB: CHECKPOINT-MIB CPU utilization per core in %. |
SNMP agent | system.cpu.util |
Load average (1m avg) | MIB: UCD-SNMP-MIB Average number of processes being executed or waiting over the last minute. |
SNMP agent | system.cpu.load.avg1 |
Load average (5m avg) | MIB: UCD-SNMP-MIB Average number of processes being executed or waiting over the last 5 minutes. |
SNMP agent | system.cpu.load.avg5 |
Load average (15m avg) | MIB: UCD-SNMP-MIB Average number of processes being executed or waiting over the last 15 minutes. |
SNMP agent | system.cpu.load.avg15 |
CPU user time | MIB: CHECKPOINT-MIB Average time the CPU has spent running user processes that are not niced. |
SNMP agent | system.cpu.user |
CPU system time | MIB: CHECKPOINT-MIB Average time the CPU has spent running the kernel and its processes. |
SNMP agent | system.cpu.system |
CPU idle time | MIB: CHECKPOINT-MIB Average time the CPU has spent doing nothing. |
SNMP agent | system.cpu.idle |
Context switches per second | MIB: UCD-SNMP-MIB Number of context switches per second. |
SNMP agent | system.cpu.switches Preprocessing
|
CPU interrupts per second | MIB: CHECKPOINT-MIB Number of interrupts processed per second. |
SNMP agent | system.cpu.intr |
Total memory | MIB: CHECKPOINT-MIB Total real memory in bytes. Memory used by applications. |
SNMP agent | vm.memory.total |
Active memory | MIB: CHECKPOINT-MIB Active real memory (memory used by applications that is not cached to the disk) in bytes. |
SNMP agent | vm.memory.active |
Free memory | MIB: CHECKPOINT-MIB Free memory available for applications in bytes. |
SNMP agent | vm.memory.free |
Used memory | Used real memory calculated by total real memory and free real memory in bytes. |
Calculated | vm.memory.used |
Memory utilization | Memory utilization in %. |
Calculated | vm.memory.util |
Encrypted packets per second | MIB: CHECKPOINT-MIB Number of encrypted packets per second. |
SNMP agent | vpn.packets.encrypted Preprocessing
|
Decrypted packets per second | MIB: CHECKPOINT-MIB Number of decrypted packets per second. |
SNMP agent | vpn.packets.decrypted Preprocessing
|
ICMP ping | Host accessibility by ICMP. 0 - ICMP ping fails. 1 - ICMP ping successful. |
Simple check | icmpping |
ICMP loss | Percentage of lost packets. |
Simple check | icmppingloss |
ICMP response time | ICMP ping response time (in seconds). |
Simple check | icmppingsec |
SNMP agent availability | Availability of SNMP checks on the host. The value of this item corresponds to the availability icons in the host list. Possible values: 0 - not available 1 - available 2 - unknown |
Zabbix internal | zabbix[host,snmp,available] |
SNMP traps (fallback) | Used to collect all SNMP traps unmatched by other |
SNMP trap | snmptrap.fallback |
SNMP walk network interfaces | Used for discovering interfaces from IF-MIB. |
SNMP agent | net.if.walk |
SNMP walk CPU | Used for discovering CPU from CHECKPOINT-MIB. |
SNMP agent | system.cpu.walk |
SNMP walk VPN tunnels | Used for discovering VPN tunnels from CHECKPOINT-MIB. |
SNMP agent | vpn.tunnel.walk |
SNMP walk disks | Used for discovering storage disks from CHECKPOINT-MIB. |
SNMP agent | vfs.fs.walk |
SNMP walk temperature sensors | Used for discovering temperature sensors from CHECKPOINT-MIB. |
SNMP agent | sensor.temp.walk |
SNMP walk fan sensors | Used for discovering fan sensors from CHECKPOINT-MIB. |
SNMP agent | sensor.fan.walk |
SNMP walk voltage sensors | Used for discovering voltage sensors from CHECKPOINT-MIB. |
SNMP agent | sensor.volt.walk |
SNMP walk PSU sensors | Used for discovering power supply sensors from CHECKPOINT-MIB. |
SNMP agent | sensor.psu.walk |
SNMP walk svn features | Used for discovering software blades and features from CHECKPOINT-MIB. |
SNMP agent | svn.feature.walk |
Triggers
Name | Description | Expression | Severity | Dependencies and additional info |
---|---|---|---|---|
Device has been replaced | The device serial number has changed. Acknowledge to close the problem manually. |
last(/Check Point Next Generation Firewall by SNMP/system.hw.serialnumber,#1)<>last(/Check Point Next Generation Firewall by SNMP/system.hw.serialnumber,#2) and length(last(/Check Point Next Generation Firewall by SNMP/system.hw.serialnumber))>0 |
Info | Manual close: Yes |
System name has changed | The name of the system has changed. Acknowledge to close the problem manually. |
last(/Check Point Next Generation Firewall by SNMP/system.name,#1)<>last(/Check Point Next Generation Firewall by SNMP/system.name,#2) and length(last(/Check Point Next Generation Firewall by SNMP/system.name))>0 |
Info | Manual close: Yes |
Device has been restarted | Uptime is less than 10 minutes. |
last(/Check Point Next Generation Firewall by SNMP/system.uptime)<10m |
Info | Manual close: Yes |
High CPU utilization | CPU utilization is too high. The system might be slow to respond. |
min(/Check Point Next Generation Firewall by SNMP/system.cpu.util,5m)>{$CPU.UTIL.CRIT} |
Warning | |
Load average is too high | The load average per CPU is too high. The system may be slow to respond. |
min(/Check Point Next Generation Firewall by SNMP/system.cpu.load.avg1,5m)/last(/Check Point Next Generation Firewall by SNMP/system.cpu.num)>{$LOAD_AVG_PER_CPU.MAX.WARN} and last(/Check Point Next Generation Firewall by SNMP/system.cpu.load.avg5)>0 and last(/Check Point Next Generation Firewall by SNMP/system.cpu.load.avg15)>0 |
Average | |
High memory utilization | The system is running out of free memory. |
min(/Check Point Next Generation Firewall by SNMP/vm.memory.util,5m)>{$MEMORY.UTIL.MAX} |
Average | |
Unavailable by ICMP ping | Last three attempts returned timeout. Please check device connectivity. |
max(/Check Point Next Generation Firewall by SNMP/icmpping,#3)=0 |
High | |
High ICMP ping loss | ICMP packet loss detected. |
min(/Check Point Next Generation Firewall by SNMP/icmppingloss,5m)>{$ICMP_LOSS_WARN} and min(/Check Point Next Generation Firewall by SNMP/icmppingloss,5m)<100 |
Warning | Depends on:
|
High ICMP ping response time | Average ICMP response time is too high. |
avg(/Check Point Next Generation Firewall by SNMP/icmppingsec,5m)>{$ICMP_RESPONSE_TIME_WARN} |
Warning | Depends on:
|
No SNMP data collection | SNMP is not available for polling. Please check device connectivity and SNMP settings. |
max(/Check Point Next Generation Firewall by SNMP/zabbix[host,snmp,available],{$SNMP.TIMEOUT})=0 |
Warning | Depends on:
|
LLD rule Firewall discovery
Name | Description | Type | Key and additional info |
---|---|---|---|
Firewall discovery | This discovery will create a set of firewall metrics from CHECKPOINT-MIB if the firewall is installed. |
SNMP agent | fw.discovery Preprocessing
|
Item prototypes for Firewall discovery
Name | Description | Type | Key and additional info |
---|---|---|---|
Check Point Firewall: Firewall filter name{#SINGLETON} | MIB: CHECKPOINT-MIB Name of the firewall filter. |
SNMP agent | fw.filter.name[fwFilterName.{#SNMPINDEX}] Preprocessing
|
Check Point Firewall: Firewall filter install time{#SINGLETON} | MIB: CHECKPOINT-MIB Last install time of the firewall filter. |
SNMP agent | fw.filter.installed[fwFilterDate.{#SNMPINDEX}] Preprocessing
|
Check Point Firewall: Firewall version{#SINGLETON} | MIB: CHECKPOINT-MIB Current version of the firewall. |
SNMP agent | fw.version[fwVersion.{#SNMPINDEX}] Preprocessing
|
Check Point Firewall: Accepted packets per second{#SINGLETON} | MIB: CHECKPOINT-MIB Number of accepted packets per second. |
SNMP agent | fw.accepted[fwAccepted.{#SNMPINDEX}] Preprocessing
|
Check Point Firewall: Rejected packets per second{#SINGLETON} | MIB: CHECKPOINT-MIB Number of rejected packets per second. |
SNMP agent | fw.rejected[fwRejected.{#SNMPINDEX}] Preprocessing
|
Check Point Firewall: Dropped packets per second{#SINGLETON} | MIB: CHECKPOINT-MIB Number of dropped packets per second. |
SNMP agent | fw.dropped[fwDropped.{#SNMPINDEX}] Preprocessing
|
Check Point Firewall: Logged packets per second{#SINGLETON} | MIB: CHECKPOINT-MIB Number of logged packets per second. |
SNMP agent | fw.logged[fwLogged.{#SNMPINDEX}] Preprocessing
|
Check Point Firewall: SIC Trust State{#SINGLETON} | MIB: CHECKPOINT-MIB Firewall SIC Trust State. |
SNMP agent | fw.sic.trust.state[fwSICTrustState.{#SNMPINDEX}] |
Check Point Firewall: Utilized drops number per second{#SINGLETON} | MIB: CHECKPOINT-MIB Number of dropped packets per second due to instance being fully utilized. |
SNMP agent | fw.utilized.drops[fwFullyUtilizedDrops.{#SNMPINDEX}] Preprocessing
|
Check Point Firewall: Concurrent connections{#SINGLETON} | MIB: CHECKPOINT-MIB Number of concurrent IPv6 and IPv4 connections. |
SNMP agent | fw.conn.num[fwNumConn.{#SNMPINDEX}] |
Check Point Firewall: Peak concurrent connections{#SINGLETON} | MIB: CHECKPOINT-MIB Peak number of concurrent connections since last reboot. |
SNMP agent | fw.conn.num.peak[fwPeakNumConn.{#SNMPINDEX}] |
Trigger prototypes for Firewall discovery
Name | Description | Expression | Severity | Dependencies and additional info |
---|---|---|---|---|
Check Point Firewall: Instance is currently fully utilized | This trigger uses the number of dropped packets, an increase of which indicates that the instance is fully utilized. |
avg(/Check Point Next Generation Firewall by SNMP/fw.utilized.drops[fwFullyUtilizedDrops.{#SNMPINDEX}],5m)>{$FW.DROPPED.PACKETS.TH} |
High |
LLD rule VPN discovery
Name | Description | Type | Key and additional info |
---|---|---|---|
VPN discovery | For discovering VPN tunnels from CHECKPOINT-MIB. |
Dependent item | vpn.discovery Preprocessing
|
Item prototypes for VPN discovery
Name | Description | Type | Key and additional info |
---|---|---|---|
VPN {#VPN.NAME}: Peer IP address | MIB: CHECKPOINT-MIB VPN peer IP address. |
Dependent item | vpn.tunnel.peer_ip[tunnelPeerIpAddr.{#SNMPINDEX}] Preprocessing
|
VPN {#VPN.NAME}: Tunnel state | MIB: CHECKPOINT-MIB VPN tunnel state: 3 - active 4 - destroy 129 - idle 130 - phase1 131 - down 132 - init |
Dependent item | vpn.tunnel.state[tunnelState.{#SNMPINDEX}] Preprocessing
|
VPN {#VPN.NAME}: Community | MIB: CHECKPOINT-MIB VPN tunnel community. |
Dependent item | vpn.tunnel.community[tunnelCommunity.{#SNMPINDEX}] Preprocessing
|
VPN {#VPN.NAME}: Tunnel interface | MIB: CHECKPOINT-MIB VPN tunnel interface. |
Dependent item | vpn.tunnel.netif[tunnelInterface.{#SNMPINDEX}] Preprocessing
|
VPN {#VPN.NAME}: Source IP | MIB: CHECKPOINT-MIB Source IP address. |
Dependent item | vpn.tunnel.src_ip[tunnelSourceIpAddr.{#SNMPINDEX}] Preprocessing
|
VPN {#VPN.NAME}: Link priority | MIB: CHECKPOINT-MIB Link priority. |
Dependent item | vpn.tunnel.priority[tunnelLinkPriority.{#SNMPINDEX}] Preprocessing
|
VPN {#VPN.NAME}: Probing state | MIB: CHECKPOINT-MIB VPN tunnel probing state: 0 - unknown 1 - alive 2 - dead |
Dependent item | vpn.tunnel.prob_state[tunnelProbState.{#SNMPINDEX}] Preprocessing
|
VPN {#VPN.NAME}: Peer type | MIB: CHECKPOINT-MIB VPN peer type. |
Dependent item | vpn.tunnel.peer_type[tunnelPeerType.{#SNMPINDEX}] Preprocessing
|
VPN {#VPN.NAME}: Tunnel type | MIB: CHECKPOINT-MIB VPN tunnel type. |
Dependent item | vpn.tunnel.type[tunnelType.{#SNMPINDEX}] Preprocessing
|
Trigger prototypes for VPN discovery
Name | Description | Expression | Severity | Dependencies and additional info |
---|---|---|---|---|
VPN {#VPN.NAME}: Tunnel down | This trigger expression works as follows: |
{$VPN.STATE.CONTROL:"{#VPN.NAME}"}=1 and last(/Check Point Next Generation Firewall by SNMP/vpn.tunnel.state[tunnelState.{#SNMPINDEX}])=131 |
Average | Manual close: Yes |
LLD rule CPU discovery
Name | Description | Type | Key and additional info |
---|---|---|---|
CPU discovery | For discovering CPU from CHECKPOINT-MIB. |
Dependent item | cpu.discovery Preprocessing
|
Item prototypes for CPU discovery
Name | Description | Type | Key and additional info |
---|---|---|---|
CPU Core {#CPU.ID}: CPU user time | MIB: CHECKPOINT-MIB The time the CPU |
Dependent item | system.core.user[multiProcUserTime.{#CPU.ID}] Preprocessing
|
CPU Core {#CPU.ID}: CPU system time | MIB: CHECKPOINT-MIB The time the CPU |
Dependent item | system.core.system[multiProcSystemTime.{#CPU.ID}] Preprocessing
|
CPU Core {#CPU.ID}: CPU idle time | MIB: CHECKPOINT-MIB The time the CPU |
Dependent item | system.core.idle[multiProcIdleTime.{#CPU.ID}] Preprocessing
|
CPU Core {#CPU.ID}: CPU utilization | MIB: CHECKPOINT-MIB CPU |
Dependent item | system.core.util[multiProcUsage.{#CPU.ID}] Preprocessing
|
LLD rule Storage discovery
Name | Description | Type | Key and additional info |
---|---|---|---|
Storage discovery | For discovering storage disks from CHECKPOINT-MIB. |
Dependent item | vfs.fs.discovery Preprocessing
|
Item prototypes for Storage discovery
Name | Description | Type | Key and additional info |
---|---|---|---|
{#DISK.NAME}: Total disk space | MIB: CHECKPOINT-MIB Total disk size in bytes. |
Dependent item | vfs.fs.total[multiDiskSize.{#SNMPINDEX}] Preprocessing
|
{#DISK.NAME}: Used disk space | MIB: CHECKPOINT-MIB Amount of disk used in bytes. |
Dependent item | vfs.fs.used[multiDiskUsed.{#SNMPINDEX}] Preprocessing
|
{#DISK.NAME}: Free disk space | MIB: CHECKPOINT-MIB Free disk capacity in bytes. |
Dependent item | vfs.fs.free[multiDiskFreeTotalBytes.{#SNMPINDEX}] Preprocessing
|
{#DISK.NAME}: Available disk space | MIB: CHECKPOINT-MIB Available free disk (not reserved by the OS) in bytes. |
Dependent item | vfs.fs.avail[multiDiskFreeAvailableBytes.{#SNMPINDEX}] Preprocessing
|
{#DISK.NAME}: Disk space utilization | Space utilization calculated by the free percentage metric |
Dependent item | vfs.fs.pused[multiDiskUsagePercent.{#SNMPINDEX}] Preprocessing
|
Trigger prototypes for Storage discovery
Name | Description | Expression | Severity | Dependencies and additional info |
---|---|---|---|---|
{#DISK.NAME}: Disk space is critically low | Two conditions should match: |
last(/Check Point Next Generation Firewall by SNMP/vfs.fs.pused[multiDiskUsagePercent.{#SNMPINDEX}])>{$DISK.PUSED.MAX.CRIT:"{#DISK.NAME}"} and (last(/Check Point Next Generation Firewall by SNMP/vfs.fs.total[multiDiskSize.{#SNMPINDEX}])-last(/Check Point Next Generation Firewall by SNMP/vfs.fs.used[multiDiskUsed.{#SNMPINDEX}]))<{$DISK.FREE.MIN.CRIT:"{#DISK.NAME}"} |
Average | Manual close: Yes |
{#DISK.NAME}: Disk space is low | Two conditions should match: |
last(/Check Point Next Generation Firewall by SNMP/vfs.fs.pused[multiDiskUsagePercent.{#SNMPINDEX}])>{$DISK.PUSED.MAX.WARN:"{#DISK.NAME}"} and (last(/Check Point Next Generation Firewall by SNMP/vfs.fs.total[multiDiskSize.{#SNMPINDEX}])-last(/Check Point Next Generation Firewall by SNMP/vfs.fs.used[multiDiskUsed.{#SNMPINDEX}]))<{$DISK.FREE.MIN.WARN:"{#DISK.NAME}"} |
Warning | Manual close: Yes Depends on:
|
LLD rule Network interfaces discovery
Name | Description | Type | Key and additional info |
---|---|---|---|
Network interfaces discovery | For discovering interfaces from IF-MIB. |
Dependent item | net.if.discovery Preprocessing
|
Item prototypes for Network interfaces discovery
Name | Description | Type | Key and additional info |
---|---|---|---|
Interface {#IFNAME}({#IFALIAS}): Operational status | MIB: IF-MIB The current operational state of the interface. - The - If - If - It should change to - It should remain in the - It should remain in the |
Dependent item | net.if.status[ifOperStatus.{#SNMPINDEX}] Preprocessing
|
Interface {#IFNAME}({#IFALIAS}): Bits received | MIB: IF-MIB The total number of octets received on the interface, including framing characters. This object is a 64-bit version of Discontinuities in the value of this counter can occur at re-initialization of the management system and at other times as indicated by the value of |
Dependent item | net.if.in[ifInOctets.{#SNMPINDEX}] Preprocessing
|
Interface {#IFNAME}({#IFALIAS}): Bits sent | MIB: IF-MIB The total number of octets transmitted out of the interface, including framing characters. This object is a 64-bit version of Discontinuities in the value of this counter can occur at re-initialization of the management system and at other times as indicated by the value of |
Dependent item | net.if.out[ifOutOctets.{#SNMPINDEX}] Preprocessing
|
Interface {#IFNAME}({#IFALIAS}): Inbound packets with errors | MIB: IF-MIB For packet-oriented interfaces - the number of inbound packets that contained errors preventing them from being deliverable to a higher-layer protocol. For character-oriented or fixed-length interfaces - the number of inbound transmission units that contained errors preventing them from being deliverable to a higher-layer protocol. Discontinuities in the value of this counter can occur at re-initialization of the management system and at other times as indicated by the value of |
Dependent item | net.if.in.errors[ifInErrors.{#SNMPINDEX}] Preprocessing
|
Interface {#IFNAME}({#IFALIAS}): Outbound packets with errors | MIB: IF-MIB For packet-oriented interfaces - the number of outbound packets that contained errors preventing them from being deliverable to a higher-layer protocol. For character-oriented or fixed-length interfaces - the number of outbound transmission units that contained errors preventing them from being deliverable to a higher-layer protocol. Discontinuities in the value of this counter can occur at re-initialization of the management system and at other times as indicated by the value of |
Dependent item | net.if.out.errors[ifOutErrors.{#SNMPINDEX}] Preprocessing
|
Interface {#IFNAME}({#IFALIAS}): Outbound packets discarded | MIB: IF-MIB The number of outbound packets which were chosen to be discarded even though no errors had been detected to prevent their being deliverable to a higher-layer protocol. One possible reason for discarding such a packet could be to free up buffer space. Discontinuities in the value of this counter can occur at re-initialization of the management system, and at other times as indicated by the value of |
Dependent item | net.if.out.discards[ifOutDiscards.{#SNMPINDEX}] Preprocessing
|
Interface {#IFNAME}({#IFALIAS}): Inbound packets discarded | MIB: IF-MIB The number of inbound packets which were chosen to be discarded even though no errors had been detected to prevent their being deliverable to a higher-layer protocol. One possible reason for discarding such a packet could be to free up buffer space. Discontinuities in the value of this counter can occur at re-initialization of the management system, and at other times as indicated by the value of |
Dependent item | net.if.in.discards[ifInDiscards.{#SNMPINDEX}] Preprocessing
|
Interface {#IFNAME}({#IFALIAS}): Interface type | MIB: IF-MIB The type of interface. Additional values for |
Dependent item | net.if.type[ifType.{#SNMPINDEX}] Preprocessing
|
Interface {#IFNAME}({#IFALIAS}): Speed | MIB: IF-MIB An estimate of the interface's current bandwidth in units of 1,000,000 bits per second. If this object reports a value of For interfaces that do not vary in bandwidth or for those where no accurate estimation can be made, this object should contain the nominal bandwidth. For a sub-layer which has no concept of bandwidth, this object should be zero. |
Dependent item | net.if.speed[ifSpeed.{#SNMPINDEX}] Preprocessing
|
Trigger prototypes for Network interfaces discovery
Name | Description | Expression | Severity | Dependencies and additional info |
---|---|---|---|---|
Interface {#IFNAME}({#IFALIAS}): Link down | This trigger expression works as follows: |
{$NET.IF.CONTROL:"{#IFNAME}"}=1 and last(/Check Point Next Generation Firewall by SNMP/net.if.status[ifOperStatus.{#SNMPINDEX}])=2 and (last(/Check Point Next Generation Firewall by SNMP/net.if.status[ifOperStatus.{#SNMPINDEX}],#1)<>last(/Check Point Next Generation Firewall by SNMP/net.if.status[ifOperStatus.{#SNMPINDEX}],#2)) |
Average | Manual close: Yes |
Interface {#IFNAME}({#IFALIAS}): High bandwidth usage | The utilization of the network interface is close to its estimated maximum bandwidth. |
(avg(/Check Point Next Generation Firewall by SNMP/net.if.in[ifInOctets.{#SNMPINDEX}],15m)>({$NET.IF.UTIL.MAX:"{#IFNAME}"}/100)*last(/Check Point Next Generation Firewall by SNMP/net.if.speed[ifSpeed.{#SNMPINDEX}]) or avg(/Check Point Next Generation Firewall by SNMP/net.if.out[ifOutOctets.{#SNMPINDEX}],15m)>({$NET.IF.UTIL.MAX:"{#IFNAME}"}/100)*last(/Check Point Next Generation Firewall by SNMP/net.if.speed[ifSpeed.{#SNMPINDEX}])) and last(/Check Point Next Generation Firewall by SNMP/net.if.speed[ifSpeed.{#SNMPINDEX}])>0 |
Warning | Manual close: Yes Depends on:
|
Interface {#IFNAME}({#IFALIAS}): High error rate | It recovers when it is below 80% of the |
min(/Check Point Next Generation Firewall by SNMP/net.if.in.errors[ifInErrors.{#SNMPINDEX}],5m)>{$NET.IF.ERRORS.WARN:"{#IFNAME}"} or min(/Check Point Next Generation Firewall by SNMP/net.if.out.errors[ifOutErrors.{#SNMPINDEX}],5m)>{$NET.IF.ERRORS.WARN:"{#IFNAME}"} |
Warning | Manual close: Yes Depends on:
|
Interface {#IFNAME}({#IFALIAS}): Ethernet has changed to lower speed than it was before | This Ethernet connection has transitioned down from its known maximum speed. This might be a sign of autonegotiation issues. Acknowledge to close the problem manually. |
change(/Check Point Next Generation Firewall by SNMP/net.if.speed[ifSpeed.{#SNMPINDEX}])<0 and last(/Check Point Next Generation Firewall by SNMP/net.if.speed[ifSpeed.{#SNMPINDEX}])>0 and ( last(/Check Point Next Generation Firewall by SNMP/net.if.type[ifType.{#SNMPINDEX}])=6 or last(/Check Point Next Generation Firewall by SNMP/net.if.type[ifType.{#SNMPINDEX}])=7 or last(/Check Point Next Generation Firewall by SNMP/net.if.type[ifType.{#SNMPINDEX}])=11 or last(/Check Point Next Generation Firewall by SNMP/net.if.type[ifType.{#SNMPINDEX}])=62 or last(/Check Point Next Generation Firewall by SNMP/net.if.type[ifType.{#SNMPINDEX}])=69 or last(/Check Point Next Generation Firewall by SNMP/net.if.type[ifType.{#SNMPINDEX}])=117 ) and (last(/Check Point Next Generation Firewall by SNMP/net.if.status[ifOperStatus.{#SNMPINDEX}])<>2) |
Info | Manual close: Yes Depends on:
|
LLD rule Temperature discovery
Name | Description | Type | Key and additional info |
---|---|---|---|
Temperature discovery | For discovering temperature sensors from CHECKPOINT-MIB. |
Dependent item | temperature.discovery Preprocessing
|
Item prototypes for Temperature discovery
Name | Description | Type | Key and additional info |
---|---|---|---|
{#SENSOR.NAME}: Temperature | MIB: CHECKPOINT-MIB Current temperature reading in degrees Celsius from the hardware component's temperature sensor. |
Dependent item | sensor.temp.value[tempertureSensorValue.{#SNMPINDEX}] Preprocessing
|
Trigger prototypes for Temperature discovery
Name | Description | Expression | Severity | Dependencies and additional info |
---|---|---|---|---|
{#SENSOR.NAME}: Temperature is above critical threshold | This trigger uses temperature sensor values. |
avg(/Check Point Next Generation Firewall by SNMP/sensor.temp.value[tempertureSensorValue.{#SNMPINDEX}],5m)>{$TEMP.VALUE.CRIT:"{#SENSOR.NAME}"} |
High | |
{#SENSOR.NAME}: Temperature is above warning threshold | This trigger uses temperature sensor values. |
avg(/Check Point Next Generation Firewall by SNMP/sensor.temp.value[tempertureSensorValue.{#SNMPINDEX}],5m)>{$TEMP.VALUE.WARN:"{#SENSOR.NAME}"} |
Warning | Depends on:
|
{#SENSOR.NAME}: Temperature is too low | This trigger uses temperature sensor values. |
avg(/Check Point Next Generation Firewall by SNMP/sensor.temp.value[tempertureSensorValue.{#SNMPINDEX}],5m)<{$TEMP.VALUE.LOW:"{#SENSOR.NAME}"} |
Average |
LLD rule FAN discovery
Name | Description | Type | Key and additional info |
---|---|---|---|
FAN discovery | For discovering fan sensors from CHECKPOINT-MIB. |
Dependent item | fan.discovery Preprocessing
|
Item prototypes for FAN discovery
Name | Description | Type | Key and additional info |
---|---|---|---|
FAN {#SNMPINDEX}: Fan status | MIB: CHECKPOINT-MIB Current status of the fan tray. |
Dependent item | sensor.fan.status[fanSpeedSensorStatus.{#SNMPINDEX}] Preprocessing
|
FAN {#SNMPINDEX}: Fan speed | MIB: CHECKPOINT-MIB Current speed of the fan. |
Dependent item | sensor.fan.speed[fanSpeedSensorValue.{#SNMPINDEX}] Preprocessing
|
Trigger prototypes for FAN discovery
Name | Description | Expression | Severity | Dependencies and additional info |
---|---|---|---|---|
FAN {#SNMPINDEX}: Fan speed is out of range | Please check the fan unit. |
count(/Check Point Next Generation Firewall by SNMP/sensor.fan.status[fanSpeedSensorStatus.{#SNMPINDEX}],#3,"eq",1)=3 |
Average |
LLD rule Voltage discovery
Name | Description | Type | Key and additional info |
---|---|---|---|
Voltage discovery | For discovering voltage sensors from CHECKPOINT-MIB. |
Dependent item | voltage.discovery Preprocessing
|
Item prototypes for Voltage discovery
Name | Description | Type | Key and additional info |
---|---|---|---|
{#SENSOR.NAME}: Voltage value | MIB: CHECKPOINT-MIB Most recent measurement obtained by the agent for this sensor. |
Dependent item | sensor.volt.value[voltageSensorValue.{#SNMPINDEX}] Preprocessing
|
LLD rule PSU discovery
Name | Description | Type | Key and additional info |
---|---|---|---|
PSU discovery | For discovering power supply sensors from CHECKPOINT-MIB. |
Dependent item | psu.discovery Preprocessing
|
Item prototypes for PSU discovery
Name | Description | Type | Key and additional info |
---|---|---|---|
PSU {#SNMPINDEX}: Power supply status | MIB: CHECKPOINT-MIB Power supply status. |
Dependent item | sensor.psu.status[powerSupplyStatus.{#SNMPINDEX}] Preprocessing
|
Trigger prototypes for PSU discovery
Name | Description | Expression | Severity | Dependencies and additional info |
---|---|---|---|---|
PSU {#SNMPINDEX}: Power supply is in down state | Please check the power supply unit for errors. |
count(/Check Point Next Generation Firewall by SNMP/sensor.psu.status[powerSupplyStatus.{#SNMPINDEX}],#3,"eq",1)=3 |
Average |
LLD rule Software blades discovery
Name | Description | Type | Key and additional info |
---|---|---|---|
Software blades discovery | For discovering software blades and features from CHECKPOINT-MIB. |
Dependent item | svn.sw.discovery Preprocessing
|
Item prototypes for Software blades discovery
Name | Description | Type | Key and additional info |
---|---|---|---|
{#SW.NAME}: License state | MIB: CHECKPOINT-MIB Current license state of the software blade. |
Dependent item | svn.sw.license.state[licensingState.{#SNMPINDEX}] Preprocessing
|
{#SW.NAME}: License expiration date | MIB: CHECKPOINT-MIB Expiration date for the license of the software blade. Doesn't return a value if the license doesn't have an expiration date. |
Dependent item | svn.sw.license.exp_date[licensingExpirationDate.{#SNMPINDEX}] Preprocessing
|
{#SW.NAME}: Software blade status | MIB: CHECKPOINT-MIB Current software blade status. |
Dependent item | svn.sw.status[licensingBladeActive.{#SNMPINDEX}] Preprocessing
|
{#SW.NAME}: License total quota | MIB: CHECKPOINT-MIB Total quota amount for the license of the software blade. |
Dependent item | svn.sw.license.quota.total[licensingTotalQuota.{#SNMPINDEX}] Preprocessing
|
{#SW.NAME}: License used quota | MIB: CHECKPOINT-MIB Used quota amount for the license of the software blade. |
Dependent item | svn.sw.license.quota.used[licensingUsedQuota.{#SNMPINDEX}] Preprocessing
|
Trigger prototypes for Software blades discovery
Name | Description | Expression | Severity | Dependencies and additional info |
---|---|---|---|---|
{#SW.NAME}: License expires soon | This trigger expression works as follows: |
{$LICENSE.CONTROL:"{#SW.NAME}"}=1 and (last(/Check Point Next Generation Firewall by SNMP/svn.sw.license.exp_date[licensingExpirationDate.{#SNMPINDEX}]) - now()) / 86400 < {$LICENSE.EXPIRY.WARN:"{#SW.NAME}"} and last(/Check Point Next Generation Firewall by SNMP/svn.sw.license.exp_date[licensingExpirationDate.{#SNMPINDEX}]) > now() |
Warning | Manual close: Yes |
{#SW.NAME}: License has been expired | This trigger expression works as follows: |
{$LICENSE.CONTROL:"{#SW.NAME}"}=1 and (last(/Check Point Next Generation Firewall by SNMP/svn.sw.license.exp_date[licensingExpirationDate.{#SNMPINDEX}]) - now()) / 86400 < now() |
Average | Manual close: Yes |
Feedback
Please report any issues with the template at https://support.zabbix.com
You can also provide feedback, discuss the template, or ask for help at ZABBIX forums