diff --git a/images/snmp__fn-cpu.png b/images/snmp__fn-cpu.png new file mode 100755 index 00000000..a2f50b0d Binary files /dev/null and b/images/snmp__fn-cpu.png differ diff --git a/images/snmp__fn-memory.png b/images/snmp__fn-memory.png new file mode 100755 index 00000000..19846583 Binary files /dev/null and b/images/snmp__fn-memory.png differ diff --git a/images/snmp__fn-sessions.png b/images/snmp__fn-sessions.png new file mode 100755 index 00000000..e6a6153e Binary files /dev/null and b/images/snmp__fn-sessions.png differ diff --git a/images/snmp__fn-vpnsessions.png b/images/snmp__fn-vpnsessions.png new file mode 100755 index 00000000..a087874c Binary files /dev/null and b/images/snmp__fn-vpnsessions.png differ diff --git a/plugins/other/snmp__fn b/plugins/other/snmp__fn new file mode 100755 index 00000000..b481995a --- /dev/null +++ b/plugins/other/snmp__fn @@ -0,0 +1,173 @@ +#!/bin/bash +# +# File: snmp__fn +# Description: SNMP plugin to monitor open sessions, sslvpn, CPU and Memory on a +# Fortigate firewall. +# +# Author: Thom Diener +# License: This program is free software; you can redistribute it and/or +# modify it under the terms of the GNU General Public License +# as published by the Free Software Foundation; version 2 dated +# June, 1991. +# +# Version: v1.00 30.10.2011 First draft of the fortigate plugin +# v1.01 19.01.2012 OID to MIB changed, plugins gets faster +# v1.02 25.01.2012 MIB file availability check added +# +# Parameters: config (required) +# autoconf (optional) +# +# Usage: place in /etc/munin/plugins/ (or link it there using ln -s) +# (Example: ln -s /usr/share/munin/plugins/snmp__fn \ +# /etc/munin/plugins/snmp_foo.example.com_fn) +# +# Global community string /etc/munin/plugin-conf.d/munin-node +# [snmp_*] +# env.community private +# timeout 45 # In case low latency or timeout +# +# Fortigate Activate snmp on your Fortigate firewall. Fortigate documentation +# at https://support.fortinet.com +# +# MIB Download and copy the original Fortigate MIB defintion file to +# /usr/share/snmp/mibs/FORTINET-300-MIB.txt (Filename depends on +# used Version) +# +# Tested with Fortinet Fortigate-50B, Firmware 3.00(MR6) on Ubuntu 10.04 LTS +# with Munin 1.4.4 installed. +# +#%# family=manual +# + + +#set -x + +### Constants ------------------------------------------------------------------ +SNMPCLIENT=`basename $0 | sed 's/^snmp_//g' | cut -d "_" -f1` +MIBFILE="/usr/share/snmp/mibs/FORTINET-300-MIB.20080414.txt" +FNTYPE=`echo $MIBFILE | cut -d "." -f1 | cut -d "/" -f6` +if [ -r $MIBFILE ]; then + SNMPGET="/usr/bin/snmpget -m $MIBFILE -c $community -v 2c $SNMPCLIENT" +else + echo no, MIB definition file not available or readable. + exit 1 +fi + +### Variables ------------------------------------------------------------------ +fnSysVersion="1.3.6.1.4.1.12356.1.3.0" +FGTcpu="$FNTYPE::fnSysCpuUsage.0" +fnSysVersion="$FNTYPE::fnSysVersion.0" +fnSysMemUsage="$FNTYPE::fnSysMemUsage.0" +fnSysSesCount="$FNTYPE::fnSysSesCount.0" +fnVPNSslStatsLoginUsers="$FNTYPE::fnVpnSslStatsLoginUsers.1" +fnVPNSslStatsActiveWebSessions="$FNTYPE::fnVpnSslStatsActiveWebSessions.1" +fnVPNSslStatsActiveTunnels="$FNTYPE::fnVpnSslStatsActiveTunnels.1" + +UNIT=`$SNMPGET $fnSysVersion | cut -d ":" -f4 | cut -d " " -f2 | cut -d "\"" -f2` +SCPU=`$SNMPGET $FGTcpu | cut -d ":" -f4 | cut -d " " -f2` +SMEM=`$SNMPGET $fnSysMemUsage | cut -d ":" -f4 | cut -d " " -f2` +SCNT=`$SNMPGET $fnSysSesCount | cut -d ":" -f4 | cut -d " " -f2` +USER=`$SNMPGET $fnVPNSslStatsLoginUsers | cut -d ":" -f4 | cut -d " " -f2` +WEBS=`$SNMPGET $fnVPNSslStatsActiveWebSessions | cut -d ":" -f4 | cut -d " " -f2` +ATUN=`$SNMPGET $fnVPNSslStatsActiveTunnels | cut -d ":" -f4 | cut -d " " -f2` + + +### Functions ------------------------------------------------------------------ + +autoconf() +{ + if [ $SCPU ]; then + echo yes, OID $FGTcpu can be readed. + else + echo no, one or multiple OID can not be readed. + exit 1 + fi + + if [ $SMEM ]; then + echo yes, OID $fnSysMemUsage can be readed. + else + echo no, one or multiple OID can not be readed. + exit 1 + fi + if [ $SCNT ]; then + echo yes, OID $fnSysSesCount can be readed. + else + echo no, one or multiple OID can not be read. + exit 1 + fi +exit 0 +} + +config() +{ + echo "multigraph fn_cpu" + echo "host_name $SNMPCLIENT" + echo "graph_title $UNIT - CPU usage" + echo 'graph_category system' + echo 'graph_vlabel %' + echo 'graph_info This graph shows current CPU usage.' + echo 'graph_args --base 1000 -r --lower-limit 0 --upper-limit 100' + echo 'forticpu.label CPU' + echo 'forticpu.info CPU usage' + echo 'forticpu.draw AREA' + echo '' + echo "multigraph fn_memory" + echo "host_name $SNMPCLIENT" + echo "graph_title $UNIT - Memory usage" + echo 'graph_category system' + echo 'graph_vlabel %' + echo 'graph_info This graph shows current memory usage.' + echo 'graph_args --base 1000 -r --lower-limit 0 --upper-limit 100' + echo 'fortimemory.label Memory' + echo 'fortimemory.info Memory usage' + echo 'fortimemory.draw AREA' + echo '' + echo "multigraph fn_sessions" + echo "host_name $SNMPCLIENT" + echo "graph_title $UNIT - Sessions" + echo 'graph_category Other' + echo 'graph_vlabel Active Sessions' + echo 'graph_info Active session count on the Fortigate firewall' + echo 'fortisessions.label Sessions' + echo 'fortisessions.info Active session count' + echo 'fortisessions.draw AREA' + echo '' + echo "multigraph fn_vpnsessions" + echo "host_name $SNMPCLIENT" + echo "graph_title $UNIT - SSLvpn Sessions" + echo 'graph_category Other' + echo 'graph_vlabel Sessions/Users' + echo 'graph_info Loged in users with SSLvpn (WebSession or Tunnel-Mode)' + echo 'fortiuser.label Users' + echo 'fortiuser.info Loged in SSLvpn users' + echo 'fortiwebs.label WebSessions' + echo 'fortiwebs.info Active SSLvpn WebSessions' + echo 'fortiatun.label ActiveTunnels' + echo 'fortiatun.info Active SSLvpn Tunnels' + exit 0 +} + +values() +{ +echo "multigraph fn_cpu" +echo "forticpu.value $SCPU" +echo "" +echo "multigraph fn_memory" +echo "fortimemory.value $SMEM" +echo "" +echo "multigraph fn_sessions" +echo "fortisessions.value $SCNT" +echo "" +echo "multigraph fn_vpnsessions" +echo "fortiuser.value $USER" +echo "fortiwebs.value $WEBS" +echo "fortiatun.value $ATUN" +} + +### Main ----------------------------------------------------------------------- + +if [ "$1" = "autoconf" ]; then autoconf +fi +if [ "$1" = "config" ]; then config +fi +values