Can GMS provide alerts when a secondary Internet line is down? (GMS Live Monitor)

03/26/2020 1064 12604

DESCRIPTION:
Setting up GMS Live Monitor for Alerting on changes to Secondary WAN Status.  GMS can provide alerts when a secondary Internet line is down.
 
Note: This article applies to GMS 6.0 and above.

RESOLUTION:

Make sure Failover & LB is setup correctly in SonicOS.  In the following setup, X1 and X3 interfaces have been setup for WAN Zone:
 

 
Enable Logical/Probe Monitoring for each of the above interfaces. For instance, for X3:
 

 
When a probe fails, the following syslog is sent:
 
<129>id=firewall sn=0017C52DFBF1 time="2011-10-04 22:33:09 UTC" fw=10.0.14.200 pri=1 c=2 m=586 msg="WLB Resource failed" n=6 src=10.50.20.21:0:X3: dst=0.0.0.0:0::
 
When the probe succeeds after having failed before, the following syslog is sent:
 
<129>id=firewall sn=0017C52DFBF1 time="2011-10-04 22:29:29 UTC" fw=10.0.14.200 pri=1 c=2 m=585 msg="WLB Resource is now available" n=6 src=10.50.20.21:0:X3: dst=0.0.0.0:0::
 
We can then use Live Monitor to capture the above syslogs and alert based on those syslogs, as follows.
Go to Monitor Tab | Live Monitor screen, and click Manage Rules.
 

 
Click on the Plus (+) icon to add a new rule and fill in the details as below:
 

 
Next click the pencil icon and fill the values as below and click Next. Note that the value 586 is associated with syslog with message “WLB Resource failed” as explained earlier.
 

 
Next, add a Destination for the Alerts, typically an email address as below and then click Finish.
 

 
Similarly, add another Rule for WLB Recovery (with message ID = 585):
 

 
In the end you will see the following two rules added:
 

 
For the rules to take effect, make sure the Syslog Forwarding is running. Click on the Settings link in Live Monitor and make sure the checkbox is selected:
 

 
If you are in the Live Monitor UI and the Reader is running (by clicking on the Play button on top left), you will see the alerts in the Window as follows:
 

 
Expanding each alert will show more details as follows:
 

 
In GMS 7.0, in addition you will be able to view the actual syslog(s).
 
The alerts will be emailed to you whether or not the Live Monitor UI is active or not.
 
Here are some sample email alerts: