# Stormshield SNS by SNMP ## Overview This template is designed for the effortless deployment of Stormshield monitoring by Zabbix via SNMP and doesn't require any external scripts. ## Requirements Zabbix version: 7.0 and higher. ## Tested versions This template has been tested on: - SNS 3100 HA v 5.0.0 ## Configuration > Zabbix should be configured according to the instructions in the [Templates out of the box](https://www.zabbix.com/documentation/7.4/manual/config/templates_out_of_the_box) section. ## Setup Refer to the vendor documentation. ## Macros used |Name|Description|Default| |----|-----------|-------| |{$SNMP_COMMUNITY}|
-
|`SI`|Text macro| |{$CPU.UTIL.CRIT}|Threshold of CPU utilization for Critical trigger in %.
|`95`| |{$CPU.UTIL.WARN}|Threshold of CPU utilization for Warning trigger in %.
|`85`| |{$DISK.FREE.CRIT}|Threshold of disk free space for Critical trigger in %.
|`10`| |{$DISK.FREE.WARN}|Threshold of disk free space for Warning trigger in %.
|`20`| |{$ICMP_LOSS_WARN}|Threshold of ICMP packet loss for Warning trigger in %.
|`20`| |{$ICMP_RESPONSE_TIME_WARN}|Threshold of average ICMP response time for Warning trigger in seconds.
|`0.15`| |{$MEMORY.UTIL.MAX}|Threshold of memory utilization for trigger in %.
|`90`| |{$NET.IF.IFNAME.NOT_MATCHES}|Usefull to exclude the sslvpn and ipsec interfaces from the network discovery.
|`^(sslvpn\|ipsec)`| |{$SNMP.TIMEOUT}|The time interval for SNMP availability trigger.
|`5m`| ## Items collected |Name|Description|Type|Key and additional info| |----|-----------|----|----| |VPN : Number of incoming policies|MIB : STORMSHIELD-IPSEC-STATS-MIB**Preprocessing**
Custom multiplier: `4096`|
|Used memory in /data|MIB : HOST-RESOURCES-MIB
Used memory in the data file in bytes.
**Preprocessing**
Custom multiplier: `4096`|
|Memory in /log|MIB : HOST-RESOURCES-MIB
Total memory in the log file in bytes.
**Preprocessing**
Custom multiplier: `4096`|
|Memory in /data|MIB : HOST-RESOURCES-MIB
Total memory in the data file in bytes.
**Preprocessing**
Custom multiplier: `4096`| |Memory utilization /log|Memory utilization in % for /log.
|`Calculated`|host.host.memory.utilization_log| |Memory utilization /data|Memory utilization in % for /data.|`Calculated`|host.host.memory.utilization_data| |Memory utilization|Memory utilization in %.|`Calculated`|host.memory.utilization| |Used memory|Used memory in bytes.|`Calculated`|host.memory.used| |Total memory|MIB : ucdavis MIB**Preprocessing**
Custom multiplier: `1000`|
|Free memory|MIB : ucdavis MIB
Free memory in bytes.
**Preprocessing**
Custom multiplier: `1000`|
|Cached memory|MIB : ucdavis MIB
Cached memory in bytes.
**Preprocessing**
Custom multiplier: `1000`| |SNMP walk Health|Used for discovering Health status from the Stormshield MIB
|`SNMP agent`|health.walk| |HA synchronisation status|MIB : STORMSHIELD-HA-MIB**Preprocessing**
Custom multiplier: `1000`|
|SNMP agent availability|Availability of SNMP checks on the host. The value of this item corresponds to availability icons in the host list.
Possible values:
0 - not available
1 - available
2 - unknown
**Preprocessing**
Javascript|
|Uptime|MIB : STORMSHIELD-SYSTEM-MONITOR-MIB
Stormshield firewall uptime in day:hour:min:sec
Device serial number has changed. Acknowledge to close the problem manually.
|`last(/SNS by SNMP/property.hardware.serial[snsSerialNumber.0],#1)<>last(/SNS by SNMP/property.hardware.serial[snsSerialNumber.0],#2) and length(last(/SNS by SNMP/property.hardware.serial[snsSerialNumber.0]))>0`|Info|**Manual close**: Yes| |SNS: Device has been restarted|Uptime is less than 10 minutes.
|`last(/SNS by SNMP/system.hardware.uptime_sec[snsUptime.0])<10m`|Info|**Manual close**: Yes| |SNS: System name has changed|The name of the system has changed. Acknowledge to close the problem manually.
|`last(/SNS by SNMP/property.hardware.name[snsSystemName.0],#1)<>last(/SNS by SNMP/property.hardware.name[snsSystemName.0],#2) and length(last(/SNS by SNMP/property.hardware.name[snsSystemName.0]))>0`|Info|**Manual close**: Yes| |SNS: High ICMP ping loss|ICMP ping loss detected.
|`min(/SNS by SNMP/icmppingloss,5m)>{$ICMP_LOSS_WARN} and min(/SNS by SNMP/icmppingloss,5m)<100`|Warning|**Depends on**:Average ICMP response time is too high.
|`avg(/SNS by SNMP/icmppingsec,5m)>{$ICMP_RESPONSE_TIME_WARN}`|Warning|**Depends on**:SNMP is not available for polling. Please check device connectivity and SNMP settings.
|`max(/SNS by SNMP/zabbix[host,snmp,available],{$SNMP.TIMEOUT})=0`|Warning|**Depends on**:There is at least one faulty HA link.
|`last(/SNS by SNMP/ha.links.faulty[snsNbFaultyHALinks.0],#1)>0`|Average|| |SNS: HA synchronization error|The cluster HA is not synchronised properly.
|`last(/SNS by SNMP/ha.sync.status[snsHASyncStatus.0],#1)<0`|Average|| |SNSha: High memory utilization|The system is running out of free memory.
|`min(/SNS by SNMP/host.memory.utilization,5m)>{$MEMORY.UTIL.MAX}`|Average|| |SNSha: High memory utilization for /data|The data file is running out of free memory.
|`min(/SNS by SNMP/host.memory.utilization_data,5m)>{$MEMORY.UTIL.MAX}`|Average|| |SNSha: High memory utilization for /log|The log file is running out of free memory.
|`min(/SNS by SNMP/host.memory.utilization_log,5m)>{$MEMORY.UTIL.MAX}`|Average|| |SNS: Unavailable by ICMP ping|Last three attempts returned timeout. Please check device connectivity.
|`max(/SNS by SNMP/icmpping,#3)=0`|High|| ## LLD rule Auto-update discovery |Name|Description|Type|Key and additional info| |----|-----------|----|----| |Auto-update discovery|Used for discovering updates from the Stormshield MIB|`Dependent item`|auto-update.discovery**Preprocessing**
SNMP walk to JSON| ## Item prototypes for Auto-update discovery |Name|Description|Type|Key and additional info| |----|-----------|----|----| |Auto-update {#UPDATE.NAME} : Last update date
|MIB : STORMSHIELD-AUTOUPDATE-MIB**Preprocessing**
SNMP walk value: `1.3.6.1.4.1.11256.1.9.1.1.4.{#SNMPINDEX}`
**Preprocessing**
SNMP walk value: `1.3.6.1.4.1.11256.1.9.1.1.3.{#SNMPINDEX}`
**Preprocessing**
SNMP walk to JSON| ## Item prototypes for CPU temperature discovery |Name|Description|Type|Key and additional info| |----|-----------|----|----| |CPU {#CPU.ID}: temperature
|MIB : STORMSHIELD-SYSTEM-MONITOR-MIBTemperature in degrees Celsius|`Dependent item`|system.cpu.temperature[snsCpuTemp.{#SNMPINDEX}]**Preprocessing**
SNMP walk value: `1.3.6.1.4.1.11256.1.10.7.1.2.{#SNMPINDEX}`
**Preprocessing**
SNMP walk to JSON| ## Item prototypes for CPU usage discovery |Name|Description|Type|Key and additional info| |----|-----------|----|----| |CPU {#CPU.ID}: temperature
|MIB : HOST-RESOURCES-MIBThe average percentage of time that this processor was not idle over the last minute. Implementations may approximate this one minute smoothing period if necessary.Note that cpu 196608 = cpu 0, 196609 = 1, ...|`Dependent item`|system.cpu.usage[hrProcessorLoad.{#SNMPINDEX}]**Preprocessing**
SNMP walk value: `1.3.6.1.2.1.25.3.3.1.2.{#SNMPINDEX}`
**Preprocessing**
SNMP walk to JSON| ## Item prototypes for Disk discovery |Name|Description|Type|Key and additional info| |----|-----------|----|----| |Disk {#DISK.ID} : Disk name
|MIB : STORMSHIELD-SYSTEM-MONITOR-MIBName of the disk|`Dependent item`|system.disk.name[snsDiskEntryDiskName.{#SNMPINDEX}]**Preprocessing**
SNMP walk value: `1.3.6.1.4.1.11256.1.10.5.1.2.{#SNMPINDEX}`
**Preprocessing**
SNMP walk value: `1.3.6.1.4.1.11256.1.10.5.1.4.{#SNMPINDEX}`
**Preprocessing**
SNMP walk value: `1.3.6.1.4.1.11256.1.10.5.1.5.{#SNMPINDEX}`
**Preprocessing**
SNMP walk value: `1.3.6.1.4.1.11256.1.10.5.1.3.{#SNMPINDEX}`
**Preprocessing**
SNMP walk to JSON| ## Item prototypes for Fan discovery |Name|Description|Type|Key and additional info| |----|-----------|----|----| |FAN {#FAN.ID}: Fan name
|MIB : STORMSHIELD-SYSTEM-MONITOR-MIBName of the Fan|`Dependent item`|system.fan.name[snsFanName.{#SNMPINDEX}]**Preprocessing**
SNMP walk value: `1.3.6.1.4.1.11256.1.10.9.1.2.{#SNMPINDEX}`
**Preprocessing**
SNMP walk value: `1.3.6.1.4.1.11256.1.10.9.1.3.{#SNMPINDEX}`
**Preprocessing**
SNMP walk value: `1.3.6.1.4.1.11256.1.10.9.1.4.{#SNMPINDEX}`
**Preprocessing**
SNMP walk to JSON| ## Item prototypes for HA members discovery |Name|Description|Type|Key and additional info| |----|-----------|----|----| |HA members {#HA.ID} : Firewall active/passive
|MIB : STORMSHIELD-HA-MIBIs the firewall active ?|`Dependent item`|ha.active[snsHAActive.{#SNMPINDEX}]**Preprocessing**
SNMP walk value: `1.3.6.1.4.1.11256.1.11.7.1.10.{#SNMPINDEX}`
**Preprocessing**
SNMP walk value: `1.3.6.1.4.1.11256.1.11.7.1.4.{#SNMPINDEX}`
**Preprocessing**
SNMP walk value: `1.3.6.1.4.1.11256.1.11.7.1.2.{#SNMPINDEX}`
**Preprocessing**
SNMP walk value: `1.3.6.1.4.1.11256.1.11.7.1.9.{#SNMPINDEX}`
**Preprocessing**
SNMP walk value: `1.3.6.1.4.1.11256.1.11.7.1.11.{#SNMPINDEX}`
**Preprocessing**
SNMP walk value: `1.3.6.1.4.1.11256.1.11.7.1.6.{#SNMPINDEX}`
**Preprocessing**
SNMP walk value: `1.3.6.1.4.1.11256.1.11.7.1.8.{#SNMPINDEX}`
**Preprocessing**
SNMP walk value: `1.3.6.1.4.1.11256.1.11.7.1.7.{#SNMPINDEX}`
**Preprocessing**
SNMP walk value: `1.3.6.1.4.1.11256.1.11.7.1.3.{#SNMPINDEX}`
**Preprocessing**
SNMP walk to JSON| ## Item prototypes for Health status discovery |Name|Description|Type|Key and additional info| |----|-----------|----|----| |Health status Firewall {#HEALTH.ID} : Admin Password
|MIB : STORMSHIELD-HEALTH-MONITOR-MIBCurrent health status of Stormshield Firewall Admin Password- 'Good' if the date on which the admin password was last changed is less than a year ago- 'Minor' if the date on which the admin password was last changed is more than a year ago- 'Major' if the admin password is the default password|`Dependent item`|health.password.status[snsPasswdHealth.{#SNMPINDEX}]**Preprocessing**
SNMP walk value: `1.3.6.1.4.1.11256.1.16.2.1.14.{#SNMPINDEX}`
**Preprocessing**
SNMP walk value: `1.3.6.1.4.1.11256.1.16.2.1.11.{#SNMPINDEX}`
**Preprocessing**
SNMP walk value: `1.3.6.1.4.1.11256.1.16.2.1.7.{#SNMPINDEX}`
**Preprocessing**
SNMP walk value: `1.3.6.1.4.1.11256.1.16.2.1.15.{#SNMPINDEX}`
**Preprocessing**
SNMP walk value: `1.3.6.1.4.1.11256.1.16.2.1.12.{#SNMPINDEX}`
**Preprocessing**
SNMP walk value: `1.3.6.1.4.1.11256.1.16.2.1.9.{#SNMPINDEX}`
**Preprocessing**
SNMP walk value: `1.3.6.1.4.1.11256.1.16.2.1.6.{#SNMPINDEX}`
**Preprocessing**
SNMP walk value: `1.3.6.1.4.1.11256.1.16.2.1.4.{#SNMPINDEX}`
**Preprocessing**
SNMP walk value: `1.3.6.1.4.1.11256.1.16.2.1.3.{#SNMPINDEX}`
**Preprocessing**
SNMP walk value: `1.3.6.1.4.1.11256.1.16.2.1.8.{#SNMPINDEX}`
**Preprocessing**
SNMP walk value: `1.3.6.1.4.1.11256.1.16.2.1.5.{#SNMPINDEX}`
**Preprocessing**
SNMP walk value: `1.3.6.1.4.1.11256.1.16.2.1.10.{#SNMPINDEX}`
**Preprocessing**
SNMP walk to JSON| ## Item prototypes for Network interface discovery |Name|Description|Type|Key and additional info| |----|-----------|----|----| |Network interface {#IF.NAME}: Accepted packets
|MIB : STORMSHIELD-IF-MIBNumber of accepted packets|`Dependent item`|network.if.accepted[snsifPktAccepted.{#SNMPINDEX}]**Preprocessing**
SNMP walk value: `1.3.6.1.4.1.11256.1.4.1.1.11.{#SNMPINDEX}`
**Preprocessing**
SNMP walk value: `1.3.6.1.4.1.11256.1.4.1.1.24.{#SNMPINDEX}`
**Preprocessing**
SNMP walk value: `1.3.6.1.4.1.11256.1.4.1.1.25.{#SNMPINDEX}`
**Preprocessing**
SNMP walk value: `1.3.6.1.4.1.11256.1.4.1.1.29.{#SNMPINDEX}`
**Preprocessing**
SNMP walk value: `1.3.6.1.4.1.11256.1.4.1.1.4.{#SNMPINDEX}`
**Preprocessing**
SNMP walk value: `1.3.6.1.4.1.11256.1.4.1.1.5.{#SNMPINDEX}`
**Preprocessing**
SNMP walk value: `1.3.6.1.4.1.11256.1.4.1.1.37.{#SNMPINDEX}`
**Preprocessing**
SNMP walk value: `1.3.6.1.4.1.11256.1.4.1.1.27.{#SNMPINDEX}`
**Preprocessing**
SNMP walk value: `1.3.6.1.4.1.11256.1.4.1.1.28.{#SNMPINDEX}`
**Preprocessing**
SNMP walk value: `1.3.6.1.4.1.11256.1.4.1.1.26.{#SNMPINDEX}`
**Preprocessing**
SNMP walk value: `1.3.6.1.4.1.11256.1.4.1.1.3.{#SNMPINDEX}`
**Preprocessing**
SNMP walk value: `1.3.6.1.4.1.11256.1.4.1.1.12.{#SNMPINDEX}`
**Preprocessing**
SNMP walk value: `1.3.6.1.4.1.11256.1.4.1.1.23.{#SNMPINDEX}`
**Preprocessing**
SNMP walk value: `1.3.6.1.4.1.11256.1.4.1.1.31.{#SNMPINDEX}`
**Preprocessing**
SNMP walk value: `1.3.6.1.4.1.11256.1.4.1.1.33.{#SNMPINDEX}`
**Preprocessing**
SNMP walk value: `1.3.6.1.4.1.11256.1.4.1.1.30.{#SNMPINDEX}`
**Preprocessing**
SNMP walk value: `1.3.6.1.4.1.11256.1.4.1.1.32.{#SNMPINDEX}`
**Preprocessing**
SNMP walk value: `1.3.6.1.4.1.11256.1.4.1.1.34.{#SNMPINDEX}`
**Preprocessing**
SNMP walk value: `1.3.6.1.4.1.11256.1.4.1.1.21.{#SNMPINDEX}`
**Preprocessing**
SNMP walk value: `1.3.6.1.4.1.11256.1.4.1.1.22.{#SNMPINDEX}`
**Preprocessing**
SNMP walk to JSON| ## Item prototypes for Power supply discovery |Name|Description|Type|Key and additional info| |----|-----------|----|----| |Firewall {#POWER.ID}: powered by electricity
|MIB : STORMSHIELD-SYSTEM-MONITOR-MIBIs power supply powered by electricity ?|`Dependent item`|system.power.on-off[snsPowerSupplyPowered.{#SNMPINDEX}]**Preprocessing**
SNMP walk value: `1.3.6.1.4.1.11256.1.10.6.1.2.{#SNMPINDEX}`
**Preprocessing**
SNMP walk value: `1.3.6.1.4.1.11256.1.10.6.1.3.{#SNMPINDEX}`