Creating Custom Performance Monitors
Creating a custom performance monitor involves creating a performance object that specifies the monitoring access protocol to use, mapping event attributes available for that protocol to FortiSIEM event attribute types, and then associating those attributes to an event type. You can use system or user-defined device types, event attribute types, and event types when creating the performance object.
This section provides the procedure to configure Performance Monitors.
Adding a performance monitor
- Go to ADMIN > Device Support > Monitoring.
- Click New and enter the information with reference to the table below:
Settings Guidelines Name Name of this performance object (for reference purposes) Type Whether the performance object is for monitoring a System-level metric or an Application-level metric. Method Method to collect this performance object (WMI). Parent Class WMI metrics are defined in the form of a parent class (for example, Win32_ComputerSystem) having multiple attributes (e.g. Domain, TotalPhysicalMemory etc.) List of Attributes Individual attributes that has to be monitored. Event Type For this performance object: Associate an event type from drop down (must be pre-created). Polling frequency Specifies how often this performance object must be polled. Description Description of this performance object - Click Save.
- Under Enter Device Type to Performance Object Mapping, click New.
- Enter a Name for the mapping.
- Select the Device Type to which you want to apply the monitor.
Whenever a device belonging to the selected device type is discovered, FortiSIEM will attempt to apply the performance monitor to it. - Select the Perf Objects.
- Click Save.
After you have successfully tested and applied the Performance Monitor, initiate discovery of the device that it will monitor, and ensure that the new monitor is enabled.
Testing a performance monitor
- Go to ADMIN > Device Support > Monitoring.
- Select the performance monitor.
- Click Test.
- For IP Address, enter the IP address of the device that you want to use to test the monitor.
- Click Test.
- If the test succeeds, click Close, and click Apply to register the new monitor with the back-end module.
Modifying a performance monitor
Follow the procedure below to modify performance monitor:
- Select one or more performance monitor(s) from the list.
- Click the required option from the following table.
- Edit to modify any performance monitor setting.
- Delete to delete a performance monitor.
- Click Save.