Enables or disables the selected Alarm Mappings. Disabled mappings do not trigger an alarm when the associated event is generated.

A green check mark indicates that the mapping is enabled. A red circle indicates that the mapping is disabled.

Name of the Event that triggers this alarm.

Name of the Alarm that is mapped to the event.

Name of the event that must be generated to clear the alarm mapped in this Alarm and Event combination.

Critical, Minor, Warning, or Informational.

Only the text of the severity is displayed. Severity icons do not display in the Alarm Mappings table.

Indicates who will be notified if this alarm is triggered, such as All Management group.

Rules that determine when the alarm is triggered. Options include:

• One Event to One Alarm: Every occurrence of the event generates a unique alarm.
• All Events to One Alarm: The first occurrence of the event generates a unique alarm. Each subsequent occurrence of the event does not generate an alarm, as long as the alarm persists when subsequent events occur. When the alarm clears, the next occurrence of the event generates another unique alarm.
• Event Frequency: Number of the occurrences of the event generated by the same element within a user specified amount of time determines the generation of a unique alarm.
• Event Lifetime: Duration of an alarm event without a clearing event within a specified time, determines the generation of a unique alarm.

Elements to which this alarm mapping applies. Options include:

• All: Applies this mapping to all elements.
• Group: Applies this mapping to a single group of elements.
• Specific: Applies this mapping to an element that you select from a list.

If an Action is enabled in the mapping, displays the action that will be taken when this alarm is triggered. Options include:

• Host Access Action: Host is disabled and then re-enabled after the specified time has passed.
• Host Role: The host's role is changed and then set back to the original role after the specified time has passed.
• Host Security Action: Host is set At Risk and then set to Safe after the specified time has passed.
• Command Line Script: You can specify a particular command line script to be executed as an alarm action.
• Email User Action: An email is sent to the user associated with the host.
• SMS User Action: An SMS Message is sent to the user associated with the host.
• Port State Action: Port is disabled and then re-enabled after the specified time has passed.
• Send Message to Desktop: Send a text message to the desktop of a host(s) with the Persistent Agent or Mobile Agent installed.

Indicates whether this alarm is sent to an external log host when the trigger event occurs, select this check box. Default = No.

To configure remote hosts that will receive externally logged alarms, see Log receivers.

Name of the command line script to be executed when this alarm is triggered. These command line scripts are for advanced use, such as administrator-created Perl scripts. Scripts are stored on the server in the following directory: /home/cm/scripts

The script will receive one packed argument that the script can parse for the desired data.

Example

'type="Network" name="FortiNAC" msg="Alarm Admin User Login Failure asserted on FortiNAC Mon Feb 27 14:34:35 EST 2017. The following Events caused the Alarm. Admin user efewfwf failed to log in. Admin user efewfwf failed to log in. Admin user efewfwf failed to log in. "'

Indicates where the event is being logged or if logging has been disabled. Options include:

• Disabled: Event is disabled and will not be generated or logged anywhere.
• Internal: Logs only to an internal events database.
• External: Logs only to an external host.
• Internal & External: Logs both to an internal events database and an external host.

Group name of a group of elements, such as port group, device group or user group used to limit generation of the selected event to the items in the group. If set to All Groups, then the event is generated for all items, such as ports, devices, hosts or users.

User name of the last user to modify the mapping.

Date and time of the last modification to this mapping.

Right click options

Deletes selected mappings from the database.

Opens the Modify dialog and allows you to modify the selected mapping.

When multiple mappings are selected, opens a limited Modify dialog and allows you to modify Severity and Notification settings. See Bulk modify alarm mappings.

Opens the admin auditing log showing all changes made to the selected item.

For information about the admin auditing log, see Audit Logs.

You must have permission to view the admin auditing log. See Add an administrator profile.

Enables the selected mappings.

Disables the selected mappings.

Disables the events associated with the selected mappings.

Enables the events associated with the selected mappings and logs to an internal events database.

Enables the events associated with the selected mappings and logs to an external host.

Enables the events associated with the selected mappings and logs to both an internal events database and an external host.