topic Email alerts for utilised interfaces and HA status (active/passive) in General Topics

Email alerts for utilised interfaces and HA status (active/passive)

mr_almeida — Mon, 20 Jan 2020 09:51:52 GMT

Hi Gang,

I have a server profile configured but completely unsure, even after some searching around.

I'd like to generate email alerts for:

Interface - in that their status changes e.g. data-link down, hard down, flapping
- Are the dedicated HA ports possible to be alerted too
Firewall goes into HA where the passive firewall takes over

I know the answer lies somewhere in custom logging, but I have no idea where to start.

We are running Panorama and Firewalls currently on 9.05.

In time, I'd love to integrate it into Webex Teams for messaging alerts, as we have an Alert Bot. This is possible right!?

Thank you kindly for taking the time and energy to read and respond!

Daniel

Re: Email alerts for utilised interfaces and HA status (active/passive)

OtakarKlier — Tue, 21 Jan 2020 21:18:10 GMT

Hello,

The configuration is on the Device tab -> Log Settings. There you can build a filter to suite your needs. I personally just have it send me all critical alerts (HA is included in these).

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Cln1CAC

Regards,

Re: Email alerts for utilised interfaces and HA status (active/passive)

BPry — Tue, 21 Jan 2020 22:01:33 GMT

@mr_almeida,

@mr_almeida wrote:
I'd like to generate email alerts for:
Interface - in that their status changes e.g. data-link down, hard down, flapping
Are the dedicated HA ports possible to be alerted too
Firewall goes into HA where the passive firewall takes over

So for an HA state-change you would want to do the following; note that you could add (severity geq high) to remove any events where someone actually suspends the firewall manually.

<filter>(eventid eq state-change)</filter> # Or to filter out suspend actions # <filter>(eventid eq state-change) and (severity geq high)</filter>

For the link changes you would actually want to look for the link-change eventid like so

<filter>(eventid eq link-change)</filter>

Re: Email alerts for utilised interfaces and HA status (active/passive)

mr_almeida — Wed, 22 Jan 2020 09:19:45 GMT

Thank you @BPry !

Exactly what I was looking for!!!

Thank you for your time and reply!

Re: Email alerts for utilised interfaces and HA status (active/passive)

mr_almeida — Wed, 22 Jan 2020 09:22:52 GMT

@OtakarKlier

I never went deep enough into the menu to see the "view filtered logs". So the video you referred was immensely useful in finally getting the overview of log settings! Looking forwarding to tweaking them to get exactly what I want!!!

Thank you too for your time and response!