All Logs Page 3

Every FortiSIEM internally generated event log regardless of category

• PH_DEV_MON_NUTANIX_CLUSTER_STATUS

• PH_DEV_MON_NUTANIX_CONTAINER_INFO

• PH_DEV_MON_NUTANIX_CTRLR_VM_RESOURCE

• PH_DEV_MON_NUTANIX_DISK_STATUS

• PH_DEV_MON_NUTANIX_DISK_TEMP

• PH_DEV_MON_NUTANIX_SERVICE_STATUS

• PH_DEV_MON_NUTANIX_STORAGE_POOL_INFO

• PH_DEV_MON_OMI_PING_STAT

• PH_DEV_MON_OSPF_NBR_STATUS

• PH_DEV_MON_PANASONIC_AERO_LOG_MON_STATUS

• PH_DEV_MON_PERFMON_ALL_DEVICE_DELAY_HIGH

• PH_DEV_MON_PERFMON_ALL_DEVICE_DELAY_LOW

• PH_DEV_MON_PERFMON_DEVICE_DELAY_HIGH

• PH_DEV_MON_PERFMON_DEVICE_DELAY_LOW

• PH_DEV_MON_PERFMON_JOB_DELAY_HIGH

• PH_DEV_MON_PERFMON_JOB_DELAY_LOW

• PH_DEV_MON_PERF_MSSQL_BACKUP_INFO

• PH_DEV_MON_PERF_MSSQL_BLOCKBY_INFO

• PH_DEV_MON_PERF_MSSQL_CONFIG_INFO

• PH_DEV_MON_PERF_MSSQL_ERROR_LOG_INFO

• PH_DEV_MON_PERF_MSSQL_GEN_INFO

• PH_DEV_MON_PERF_MSSQL_LOCK_INFO

• PH_DEV_MON_PERF_MSSQL_PERDB

• PH_DEV_MON_PERF_MSSQL_SYS

• PH_DEV_MON_PERF_MSSQL_TOP_QUERIES

• PH_DEV_MON_PERF_MYSQLDB

• PH_DEV_MON_PERF_MYSQLDB_TABLESPACE

• PH_DEV_MON_PERF_ORADB

• PH_DEV_MON_PERF_ORADB_CLUSTER

• PH_DEV_MON_PERF_ORADB_TABLESPACE

• PH_DEV_MON_PERF_ORADB_TOP_QUERIES

• PH_DEV_MON_PING_STAT

• PH_DEV_MON_PING_STAT_SUPPRESSED

• PH_DEV_MON_PORT_CLOSE

• PH_DEV_MON_PORT_OPEN

• PH_DEV_MON_PRINTER_OUTPUT_STATUS

• PH_DEV_MON_PRINTER_SUPPLY_STATUS

• PH_DEV_MON_PROC_CPU_UTIL

• PH_DEV_MON_PROC_MEM_UTIL

• PH_DEV_MON_PROC_RESOURCE_UTIL

• PH_DEV_MON_PROC_START

• PH_DEV_MON_PROC_STOP

• PH_DEV_MON_QUALYS_WEB_APP_FW

• PH_DEV_MON_RBD_BW

• PH_DEV_MON_RBD_CONN

• PH_DEV_MON_RBD_PEER_STAT

• PH_DEV_MON_RBD_PER_PORT_BW

• PH_DEV_MON_RBD_TOP_APP

• PH_DEV_MON_RBD_TOP_DEST

• PH_DEV_MON_RBD_TOP_SRC

• PH_DEV_MON_RBD_TOP_TALKER

• PH_DEV_MON_RDS_METRIC

• PH_DEV_MON_RUCKUS_ACCESS_POINT_STAT

• PH_DEV_MON_RUCKUS_CONTROLLER_STAT

• PH_DEV_MON_RUCKUS_SSID_PERF

• PH_DEV_MON_SERVERIRON_REAL_SERVER_STAT

• PH_DEV_MON_SLB_METRIC

• PH_DEV_MON_SNMP_PING_STAT

• PH_DEV_MON_SRC_AD_REPL_STAT

• PH_DEV_MON_STATUS

• PH_DEV_MON_STORAGE_PORT_DOWN_TO_UP

• PH_DEV_MON_STORAGE_PORT_UP_TO_DOWN

• PH_DEV_MON_SYS_CPU_UTIL

• PH_DEV_MON_SYS_DISK_FREE

• PH_DEV_MON_SYS_DISK_TREND_DAY

• PH_DEV_MON_SYS_DISK_TREND_MONTH

• PH_DEV_MON_SYS_DISK_TREND_WEEK

• PH_DEV_MON_SYS_DISK_UTIL

• PH_DEV_MON_SYS_EXT_CMD

• PH_DEV_MON_SYS_MEM_FREE

• PH_DEV_MON_SYS_MEM_UTIL

• PH_DEV_MON_SYS_PAGEFILE_USAGE

• PH_DEV_MON_SYS_PER_CPU_UTIL

• PH_DEV_MON_SYS_PROC_COUNT

• PH_DEV_MON_SYS_RESTART

• PH_DEV_MON_SYS_STAT

• PH_DEV_MON_SYS_STATUS

• PH_DEV_MON_SYS_SWAP_MEM_ERROR_MSG

• PH_DEV_MON_SYS_UPTIME

• PH_DEV_MON_SYS_VIRT_MEM_UTIL

• PH_DEV_MON_TARGET_FILE_CONTENT_CHANGE

• PH_DEV_MON_TOMCAT_CPU

• PH_DEV_MON_TOMCAT_DB

• PH_DEV_MON_TOMCAT_MEMORY

• PH_DEV_MON_TOMCAT_REQUEST_PROCESSOR

• PH_DEV_MON_TOMCAT_SERVLET

• PH_DEV_MON_TOMCAT_SESSION

• PH_DEV_MON_TOMCAT_THREAD_POOL

• PH_DEV_MON_TRACEROUTE_STAT

• PH_DEV_MON_UCS_HW_CHASSIS_STAT

• PH_DEV_MON_UCS_HW_FAN_STAT

• PH_DEV_MON_UCS_HW_MEMORY_STAT

• PH_DEV_MON_UCS_HW_PROCESSOR_STAT

• PH_DEV_MON_UCS_HW_PSU_STAT

• PH_DEV_MON_UPS_METRIC

• PH_DEV_MON_VMCLUSTER_CPU_UTIL

• PH_DEV_MON_VMCLUSTER_DATASTORE_IO

• PH_DEV_MON_VMCLUSTER_MEM_UTIL

• PH_DEV_MON_VMCLUSTER_STATUS

• PH_DEV_MON_VMRESPOOL_CPU_UTIL

• PH_DEV_MON_VMRESPOOL_MEM_UTIL

• PH_DEV_MON_VM_CPU_UTIL

• PH_DEV_MON_VM_DATASTORE_IO

• PH_DEV_MON_VM_DISK_IO

• PH_DEV_MON_VM_DISK_UTIL

• PH_DEV_MON_VM_MEM_UTIL

• PH_DEV_MON_VM_NET_INTF_UTIL

• PH_DEV_MON_VM_PER_CPU_UTIL

• PH_DEV_MON_VM_SNAPSHOT

• PH_DEV_MON_VM_STATE

• PH_DEV_MON_VM_TOOLS_STATUS

• PH_DEV_MON_VM_UPTIME

• PH_DEV_MON_VPN_CONN

• PH_DEV_MON_VPN_STATUS

• PH_DEV_MON_WATCHGUARD_POLICY_STAT

• PH_DEV_MON_WEBLOGIC_APP

• PH_DEV_MON_WEBLOGIC_DB_POOL

• PH_DEV_MON_WEBLOGIC_EJB

• PH_DEV_MON_WEBLOGIC_GEN

• PH_DEV_MON_WEBLOGIC_MEMORY

• PH_DEV_MON_WEBLOGIC_SERVLET

• PH_DEV_MON_WEBLOGIC_SESSION

• PH_DEV_MON_WEBLOGIC_THREAD_POOL

• PH_DEV_MON_WEBSPHERE_APP

• PH_DEV_MON_WEBSPHERE_AUTHENTICATION

• PH_DEV_MON_WEBSPHERE_CPU

• PH_DEV_MON_WEBSPHERE_DB_POOL

• PH_DEV_MON_WEBSPHERE_EJB

• PH_DEV_MON_WEBSPHERE_MEMORY

• PH_DEV_MON_WEBSPHERE_SERVLET

• PH_DEV_MON_WEBSPHERE_THREAD_POOL

• PH_DEV_MON_WEBSPHERE_TRANSACTION

• PH_DEV_MON_WMI_PING_STAT

• PH_DISCOVERY_COMPLETE

• PH_DISCOVERY_RESULT_SENT

• PH_DISCOV_ACCESS_IP_PARSE_ERROR

• PH_DISCOV_ADS_ACCOUNT_TO_EXPIRE

• PH_DISCOV_ADS_ACCT_DISABLED

• PH_DISCOV_ADS_DORMANT_ACCT

• PH_DISCOV_ADS_PASSWORD_NEVER_EXPIRES

• PH_DISCOV_ADS_PASSWORD_NOT_REQD

• PH_DISCOV_ADS_PASSWORD_STALE

• PH_DISCOV_ADS_PASSWORD_TO_EXPIRE

• PH_DISCOV_ARUBA_WLAN_HOST_LOCATION

• PH_DISCOV_AWS_DEVICE_DELETED

• PH_DISCOV_AWS_DEVICE_UNKNOWN

• PH_DISCOV_AWS_DISCOV_FAILED

• PH_DISCOV_AZURE_DISCOV_FAILED

• PH_DISCOV_BASIC_FAILED

• PH_DISCOV_BASIC_SKIPPED

• PH_DISCOV_BASIC_SNMP_DETAIL

• PH_DISCOV_BASIC_SNMP_ERROR

• PH_DISCOV_BASIC_SNMP_FAILED

• PH_DISCOV_BASIC_SNMP_STARTED

• PH_DISCOV_BASIC_SNMP_SUCCESS

• PH_DISCOV_BASIC_SSH_DETAIL

• PH_DISCOV_BASIC_SSH_ERROR

• PH_DISCOV_BASIC_SSH_FAILED

• PH_DISCOV_BASIC_SSH_STARTED

• PH_DISCOV_BASIC_SSH_SUCCESS

• PH_DISCOV_BASIC_STARTED

• PH_DISCOV_BGP_OSPF_FAILED

• PH_DISCOV_BROCADE_SERVER_IRON_HW_INFO_WARNING

• PH_DISCOV_CANCEL_UNKNOWN_REQ

• PH_DISCOV_CERT_FILE_DOWNLOAD_FAILURE

• PH_DISCOV_CHECKPOINT_TEST_CONN_FAILED

• PH_DISCOV_CISCO_ASA_GET_CONTEXT_FAILED

• PH_DISCOV_CISCO_ASA_IPSEC_VPN_FAILED

• PH_DISCOV_CISCO_ASA_RAS_VPN_FAILED

• PH_DISCOV_CISCO_ASA_RUN_CONFIG_FAILED

• PH_DISCOV_CISCO_ASA_SET_CONTEXT_FAILED

• PH_DISCOV_CISCO_ASA_STARTUP_CONFIG_FAILED

• PH_DISCOV_CISCO_CALL_MANAGER_WARNING

• PH_DISCOV_CISCO_CATOS_INTF_FAILED

• PH_DISCOV_CISCO_CDP_ERROR

• PH_DISCOV_CISCO_IOS_L2_WARNING

• PH_DISCOV_CISCO_IOS_TRUNK_PORT_ERROR

• PH_DISCOV_CISCO_JUNOS_L2_WARNING

• PH_DISCOV_CISCO_NXOS_HW_STATUS_WARNING

• PH_DISCOV_CISCO_NXOS_INTF_SHORT_NAME_NOT_FOUND

• PH_DISCOV_CISCO_NXOS_L2_WARNING

• PH_DISCOV_CISCO_WLAN_HOST_LOCATION

• PH_DISCOV_CLOCK_ROLLS_BACK

• PH_DISCOV_CONTACT_APP_SERVER

• PH_DISCOV_CREDEN_INSERT_ERROR

• PH_DISCOV_CUSTOM_MAP_LOAD_FAILED

• PH_DISCOV_DATA_DOMAIN_HW_STATUS_WARNING

• PH_DISCOV_DELL_BLADE_CHASSIS_WARNING

• PH_DISCOV_DELL_COMPELLENT_STORAGE_WARNING

• PH_DISCOV_DISCOV_REQ_GET_FAILED

• PH_DISCOV_DISCOV_RESULT_SENDER_THREADS_SPAWN_FAILED

• PH_DISCOV_DISCOV_THREADS_SPAWN_FAILED

• PH_DISCOV_EC2_INSTANCE_PARSE_FAILED

• PH_DISCOV_EMC_CLARION_ERROR

• PH_DISCOV_EMC_VNX_DISCOV_FAILED

• PH_DISCOV_EMC_VNX_PING_FAILED

• PH_DISCOV_EQLOGIC_CONN_FAILED

• PH_DISCOV_EQLOGIC_HW_INFO_FAILED

• PH_DISCOV_ESX_HOST_PING_ONLY_DISCOV_ERROR

• PH_DISCOV_FAILED_INVALID_REQUEST

• PH_DISCOV_FAILED_INVALID_REQUEST_XML

• PH_DISCOV_FAILED_XML_ERROR

• PH_DISCOV_FAIL_CMDB_DEV

• PH_DISCOV_FILE_BASED_DISCOV_DIR_NOT_CONFIGURED

• PH_DISCOV_FILE_BASED_DISCOV_FAILED

• PH_DISCOV_FORTINET_CPU_INFO_WARNING

• PH_DISCOV_FORTINET_LINK_STAT_WARNING

• PH_DISCOV_FORTINET_SYS_UPDATE_VERSION_WARNING

• PH_DISCOV_GENERIC_ERROR

• PH_DISCOV_GEN_WLAN_HOST_LOCATION

• PH_DISCOV_GET_SNMP_ENGINE_ID_FAILED

• PH_DISCOV_HOST_CONVERT_PROCESS_UPTIME_ERROR

• PH_DISCOV_HOST_ERROR

• PH_DISCOV_HOST_INSTALL_SW_WARNING

• PH_DISCOV_HOST_LOCATE_PROCESS_ERROR

• PH_DISCOV_HOST_LOCATION

• PH_DISCOV_HOST_NET_INTF

• PH_DISCOV_HOST_STARTED

• PH_DISCOV_HOST_SUCCESS

• PH_DISCOV_HOST_SUCCESS_DETAIL

• PH_DISCOV_HOST_WARNING

• PH_DISCOV_HP3COM_HW_WARNING

• PH_DISCOV_HP_BLADE_HW_STATUS_WARNING

• PH_DISCOV_INIT_MODULE_FAILED

• PH_DISCOV_INTERFACE_VIA_SNMP_FAILED

• PH_DISCOV_IP_TYPE_INVALID

• PH_DISCOV_ISILON_HW_STATUS_WARNING

• PH_DISCOV_JMX_TEST_CONN_FAILED

• PH_DISCOV_JUNIPER_SSG_HW_INFO_WARNING

• PH_DISCOV_L2_FAILED

• PH_DISCOV_L2_STARTED

• PH_DISCOV_L2_SUCCESS

• PH_DISCOV_LDAP_ERROR

• PH_DISCOV_LDAP_OU_ERROR

• PH_DISCOV_LINUX_DSKTABLE_NOT_CONFIG

• PH_DISCOV_LOGIN_ERROR

• PH_DISCOV_NEXT_HOP_VIA_SNMP_FAILED

• PH_DISCOV_NIMBLE_VOLUME_WARNING

• PH_DISCOV_NOZOMI_DISCOV_FAILED

• PH_DISCOV_PARAM_PARSE_FAILED

• PH_DISCOV_PARSER_MSG_EXCEEDS_THRESHOLD

• PH_DISCOV_PARSER_MSG_THREAD_SPAWN_FAILED

• PH_DISCOV_PERF_TEMPLATE_LOAD_FAILED

• PH_DISCOV_PING_ONLY_LIST_NOT_MATCH

• PH_DISCOV_READ_COMPRESS_THRESHOLD_FAILED

• PH_DISCOV_RECVD_VALID_REQUEST

• PH_DISCOV_RESULT_SEND_FAILED

• PH_DISCOV_RESULT_SEND_WARNING

• PH_DISCOV_RESULT_XML_WRITE_FAILURE

• PH_DISCOV_RUNNING_SERVICE

• PH_DISCOV_RUN_JAVA_PROBE_ERROR

• PH_DISCOV_RUN_SW_FILTER_LOAD_FAILED

• PH_DISCOV_RUN_SW_FILTER_PARSE_FAILED

• PH_DISCOV_RUN_VM_TEST_CONN_ERROR

• PH_DISCOV_SKIPPED

• PH_DISCOV_SKIP_DEV

• PH_DISCOV_SNMP_ERROR

• PH_DISCOV_SSH_ERROR

• PH_DISCOV_START

• PH_DISCOV_TELNET_ERROR

• PH_DISCOV_TEST_CONN_GET_REQ_FAILED

• PH_DISCOV_TEST_CONN_MSRPC_ERROR

• PH_DISCOV_TEST_CONN_NO_UCSAPI_CRED

• PH_DISCOV_TEST_CONN_RESULT_SENDER_THREADS_SPAWN_FAILED

• PH_DISCOV_TEST_CONN_RESULT_SEND_ERROR

• PH_DISCOV_TEST_CONN_RESULT_SEND_WARNING

• PH_DISCOV_TEST_CONN_THREADS_SPAWN_FAILED

• PH_DISCOV_TEST_CONN_VMSDK_ERROR

• PH_DISCOV_TRIPP_UPS_HW_STATUS_WARNING

• PH_DISCOV_TRUNK_PORTS_ERROR

• PH_DISCOV_UNHANDLED_ACCESS_PROTO

• PH_DISCOV_UPLOAD_DATA_FAILED

• PH_DISCOV_VMWARE_DUP_DEV_ID

• PH_DISCOV_VMWARE_ERROR

• PH_DISCOV_VOIP_PHONE_ID

• PH_DISCOV_WMI_PULL_ERROR

• PH_DISC_DATA_PROCESS_ERROR

• PH_DIVIDE_BY_ZERO

• PH_DROP_EVENT_FROM_SHARED_BUFFER

• PH_DROP_INCIDENT

• PH_DROP_INCIDENT_COUNT

• PH_ES_ARCHIVE_STORAGE_CHECK_ERROR

• PH_ES_ARCHIVE_STORAGE_LOW

• PH_ES_ARCHIVE_STORAGE_PURGING_FAILED

• PH_ES_ARCHIVE_STORAGE_PURGING_FINISHED

• PH_ES_ARCHIVE_STORAGE_PURGING_STARTED

• PH_ES_ARCHIVE_STORAGE_PURGING_SUCCESS

• PH_ES_ARCHIVE_STORAGE_USAGE

• PH_ES_CCR_DELAY

• PH_ES_COLD_STORAGE_ARCHIVING_FAILED

• PH_ES_COLD_STORAGE_ARCHIVING_FINISHED

• PH_ES_COLD_STORAGE_ARCHIVING_STARTED

• PH_ES_COLD_STORAGE_ARCHIVING_SUCCESS

• PH_ES_COLD_STORAGE_CHECK_ERROR

• PH_ES_COLD_STORAGE_LOW

• PH_ES_COLD_STORAGE_PURGING_FAILED

• PH_ES_COLD_STORAGE_PURGING_FINISHED

• PH_ES_COLD_STORAGE_PURGING_STARTED

• PH_ES_COLD_STORAGE_PURGING_SUCCESS

• PH_ES_COLD_STORAGE_USAGE

• PH_ES_HOTCOLD_STORAGE_MOVING_FAILED

• PH_ES_HOTCOLD_STORAGE_MOVING_FINISHED

• PH_ES_HOTCOLD_STORAGE_MOVING_STARTED

• PH_ES_HOTCOLD_STORAGE_MOVING_SUCCESS

• PH_ES_HOT_STORAGE_ARCHIVING_FAILED

• PH_ES_HOT_STORAGE_ARCHIVING_FINISHED

• PH_ES_HOT_STORAGE_ARCHIVING_STARTED

• PH_ES_HOT_STORAGE_ARCHIVING_SUCCESS

• PH_ES_HOT_STORAGE_CHECK_ERROR

• PH_ES_HOT_STORAGE_LOW

• PH_ES_HOT_STORAGE_MOVING_FAILED

• PH_ES_HOT_STORAGE_MOVING_FINISHED

• PH_ES_HOT_STORAGE_MOVING_STARTED

• PH_ES_HOT_STORAGE_MOVING_SUCCESS

• PH_ES_HOT_STORAGE_PURGING_FAILED

• PH_ES_HOT_STORAGE_PURGING_FINISHED

• PH_ES_HOT_STORAGE_PURGING_STARTED

• PH_ES_HOT_STORAGE_PURGING_SUCCESS

• PH_ES_HOT_STORAGE_USAGE

• PH_ES_INDEX_SEGMENT_MERGE_FAILED

• PH_ES_REST_FAILED

• PH_ES_SM_ADD_INDEX_FAILED

• PH_ES_SM_HOURCHECK_FAILED

• PH_ES_SM_INIT_FAILED

• PH_ES_SM_INIT_INDEX_FAILED

• PH_ES_SNAPSHOT_FAILED

• PH_ES_TO_NFS_ARCHIVE_FAILED_ADD_INDEX

• PH_ES_WARM_STORAGE_ARCHIVING_FAILED

• PH_ES_WARM_STORAGE_ARCHIVING_FINISHED

• PH_ES_WARM_STORAGE_ARCHIVING_STARTED

• PH_ES_WARM_STORAGE_ARCHIVING_SUCCESS

• PH_ES_WARM_STORAGE_CHECK_ERROR

• PH_ES_WARM_STORAGE_LOW

• PH_ES_WARM_STORAGE_MOVING_FAILED

• PH_ES_WARM_STORAGE_MOVING_FINISHED

• PH_ES_WARM_STORAGE_MOVING_STARTED

• PH_ES_WARM_STORAGE_MOVING_SUCCESS

• PH_ES_WARM_STORAGE_PURGING_FAILED

• PH_ES_WARM_STORAGE_PURGING_FINISHED

• PH_ES_WARM_STORAGE_PURGING_STARTED

• PH_ES_WARM_STORAGE_PURGING_SUCCESS

• PH_ES_WARM_STORAGE_USAGE

• PH_EVENT_ATTR_XML_ISSUE

• PH_EVENT_FORWARDER_CHECKSUM_MISMATCH

• PH_EVENT_FORWARDER_CONNECT_ERROR

• PH_EVENT_FORWARDER_DIR_OPEN_FAILURE

• PH_EVENT_FORWARDER_FILE_OPEN_FAILURE

• PH_EVENT_FORWARDER_FILE_RENAME_FAILURE

• PH_EVENT_FORWARDER_INIT_FAILURE

• PH_EVENT_FORWARDER_INVALID_GZIP_FILE

• PH_EVENT_FORWARDER_INVALID_PHOENIX_CONFIG

• PH_EVENT_FORWARDER_INVALID_PROTOCOL

• PH_EVENT_FORWARDER_KAFKA_ERROR

• PH_EVENT_FORWARDER_KAFKA_INIT_FAILURE

• PH_EVENT_FORWARDER_KAFKA_PRODUCE_ERROR

• PH_EVENT_FORWARDER_MKDIR_FAILURE

• PH_EVENT_FORWARDER_RUN_PROCESS_ERROR

• PH_EVENT_FORWARDER_SOCKET_ERROR

• PH_EVENT_FORWARDER_SOCKET_WRITE_ERROR

• PH_EVENT_FORWARDER_SSL_CERT_ERROR

• PH_EVENT_FORWARDER_SSL_ERROR

• PH_EVENT_FWD_CERT_LOAD_FAILED

• PH_EVENT_FWD_CERT_UNPAIRED

• PH_EVENT_FWD_DIR_MAKE_FAILED

• PH_EVENT_FWD_DIR_OPEN_FAILED

• PH_EVENT_FWD_FILE_RENAME_FAILED

• PH_EVENT_FWD_FULL_FORWARDING_FAILED

• PH_EVENT_FWD_GET_FILE_NUM_FAILURE

• PH_EVENT_FWD_GZ_CLOSE_ERROR

• PH_EVENT_FWD_GZ_FILE_OPEN_ERROR

• PH_EVENT_FWD_GZ_MD5_ERROR

• PH_EVENT_FWD_GZ_RENAME_ERROR

• PH_EVENT_FWD_GZ_SIZE_MISMATCH

• PH_EVENT_FWD_KAFKA_WARNING

• PH_EVENT_FWD_MD5_CHECKSUM_MISMATCH

• PH_EVENT_FWD_NETFLOW_REGEX_IGNORED

• PH_EVENT_FWD_PARTIAL_FORWARDING_FAILED

• PH_EVENT_FWD_PARTIAL_FORWARDING_WARNING

• PH_EVENT_FWD_PCRE_ERROR

• PH_EVENT_FWD_PROCESS_INIT_FAILED

• PH_EVENT_FWD_PROCESS_START_FAILED

• PH_EVENT_FWD_PROTO_FORWARDED_WRONG

• PH_EVENT_FWD_RENAME_GZ_ERROR

• PH_EVENT_FWD_RULE_PARSE_ERROR

• PH_EVENT_FWD_SOCKET_CONNECT_FAILED

• PH_EVENT_FWD_SOCKET_GET_FAILED

• PH_EVENT_FWD_SOCKET_WRITE_FAILED

• PH_EVENT_FWD_SSL_CREATE_FAILED

• PH_EVENT_FWD_SSL_SESSION_BUILD_FAILED

• PH_EVENT_FWD_UNEXPECTED_FILE_REMOVED

• PH_EVENT_PKG_ATTR_NOT_FOUND

• PH_EVENT_PKG_EMPTY_FILE_REMOVED

• PH_EVENT_PKG_FILE_ADD_TO_SVN_FAILED

• PH_EVENT_PKG_FILE_REMOVED_ERROR

• PH_EVENT_PKG_FILE_RENAME_FAILED

• PH_EVENT_PKG_FILE_STAT_FAILED

• PH_EVENT_PKG_FILE_UPLOAD_FAILED

• PH_EVENT_PKG_FILE_UPLOAD_SUCCESS_HIGH

• PH_EVENT_PKG_FILE_UPLOAD_SUCCESS_LOW

• PH_EVENT_PKG_GZ_CLOSE_FAILED

• PH_EVENT_PKG_GZ_FILE_OPEN_ERROR

• PH_EVENT_PKG_HTTP_FAILED

• PH_EVENT_PKG_HTTP_INIT_FAILED

• PH_EVENT_PKG_INSERT_TASK_FAILED

• PH_EVENT_PKG_NO_EVENT

• PH_EVENT_PKG_OPEN_DIR_FAILED

• PH_EVENT_PKG_PROCESS_INIT_FAILED

• PH_EVENT_PKG_PROCESS_START_FAILED

• PH_EVENT_PKG_QUEUE_GET_FAILED

• PH_EVENT_PKG_SERVER_LIST_UPLOAD_FAILED

• PH_EVENT_PKG_SERVICE_LIST_EMPTY

• PH_EVENT_PKG_TASK_ADD_TO_QUEUE_FAILED

• PH_EVENT_PKG_XML_PARSE_FAILED

• PH_EVTPKGER_FILE_UPLOAD_FAILED

• PH_EVT_HANDLER_DBG

• PH_EVT_HANDLER_ERR

• PH_EVT_HANDLER_EVT_QUEUE_LARGE

• PH_EVT_HANDLER_EVT_QUEUE_WARNING

• PH_EVT_HANDLER_INFO

• PH_EVT_HANDLER_SVN_QUEUE_LARGE

• PH_EVT_HANDLER_SVN_QUEUE_WARNING

• PH_EVT_PACKAGER_COND_WAIT_ERROR

• PH_EVT_PACKAGER_FILE_CLOSE_FAILURE

• PH_EVT_PACKAGER_FILE_OPEN_FAILURE

• PH_EVT_PACKAGER_FILE_REMOVE_FAILURE

• PH_EVT_PACKAGER_FILE_RENAME_FAILURE

• PH_EVT_PACKAGER_FILE_STAT_FAILURE

• PH_EVT_PACKAGER_FILE_UPLOAD_FAILURE

• PH_EVT_PACKAGER_HTTP_RESPONSE_ERROR

• PH_EVT_PACKAGER_INIT_FAILURE

• PH_EVT_PACKAGER_REST_PARSE_ERROR

• PH_EVT_PACKAGER_RUN_PROCESS_ERROR

• PH_FAILED_TO_EXEC

• PH_FILE_NOT_FOUND

• PH_GCS_BUCKET_ACCESS_FAILURE

• PH_GENERIC_CRITICAL

• PH_GENERIC_DEBUG

• PH_GENERIC_ERROR

• PH_GENERIC_INFO

• PH_GENERIC_WARNING

• PH_GET_CURL_HANDLE_FAILED

• PH_GET_SUPER_LEADER_FAILURE

• PH_GRPC_CERT_CREATE_SUCCESS

• PH_GRPC_CERT_ERROR

• PH_GRPC_CERT_LOADED_FAILED

• PH_GRPC_CERT_UPDATE_FAILED

• PH_GRPC_CERT_UPDATE_SUCCESS

• PH_GRPC_FORTMAT_JSON_FAILED

• PH_GRPC_TASK_DATA_EMPTY

• PH_HDFS_ARCHIVE_STORAGE_LOW

• PH_HDFS_ARCHIVE_STORAGE_USAGE

• PH_HDFS_PURGING_FAILED

• PH_HDFS_PURGING_FINISHED

• PH_HDFS_PURGING_STARTED

• PH_HDFS_PURGING_SUCCESS

• PH_HTTP_CLIENT_COMPRESS_FAILED

• PH_HTTP_CLIENT_CURL_ERROR

• PH_HTTP_CLIENT_GET_CACHE_FROM_MONITOR_FAILED

• PH_HTTP_CLIENT_GET_DATA_FROM_CACHE_FAILED

• PH_HTTP_CLIENT_GET_INIT_RESPONSE_FAILED

• PH_HTTP_CLIENT_GET_INIT_RESPONSE_WARNING

• PH_HTTP_CLIENT_GET_RESPONSE_WARNING

• PH_HTTP_CLIENT_HOST_IS_NULL

• PH_HTTP_CLIENT_INIT_FAILURE

• PH_HTTP_CLIENT_INIT_WARNING

• PH_HTTP_CLIENT_INVALID_FILE_SIZE

• PH_HTTP_CLIENT_MKSTEMP_FAILED

• PH_HTTP_CLIENT_NO_FILE_PARAM

• PH_HTTP_CLIENT_PICK_SUPER_FAILED

• PH_HTTP_CLIENT_PREP_REQUEST_ERROR

• PH_HTTP_CLIENT_PUT_REDIRECT_FAILURE

• PH_HTTP_CLIENT_SETOPT_FAILED

• PH_HTTP_CLIENT_SET_HOST_WARNING

• PH_HTTP_CLIENT_UPLOAD_FILE_FAILED

• PH_HTTP_CLIENT_WRITE_CACHE_NULL

• PH_HTTP_INIT_FAILURE

• PH_HTTP_RESPONSE_FAILURE

• PH_IDENTITYMASTER_HTTP_UPLOAD_ERROR

• PH_IDENTITYMASTER_INIT_ERROR

• PH_IDENTITYWORKER_ATTRIB_ERROR

• PH_IDENTITYWORKER_EVT_LOAD_ERROR

• PH_IDENTITYWORKER_EVT_SEND_ERROR

• PH_IDENTITYWORKER_INIT_ERROR

• PH_IDENTITYWORKER_PARAM_ERROR

• PH_IDENTITYWORKER_PROCESSING_EPS

• PH_IDENTITYWORKER_SS_OBTAIN_ERROR

• PH_INCIDENT_ACTION_STATUS

• PH_INVALID_IP_ADDR

• PH_INVALID_PARAM

• PH_INVALID_PARAM_CNT

• PH_INVALID_PARAM_VAL_EMPTY

• PH_JAVA_AGENT_APPSERVER_CONN_ERROR

• PH_JAVA_AGENT_APPSERVER_EXECUTE_ERROR

• PH_JAVA_AGENT_CONTROLLER_CMD_PARSE_ERROR

• PH_JAVA_AGENT_CONTROLLER_CMD_READ_ERROR

• PH_JAVA_AGENT_CONTROLLER_GENERIC_ERROR

• PH_JAVA_AGENT_CONTROLLER_LINE_READ_ERROR

• PH_JAVA_AGENT_CONTROLLER_XML_READ_ERROR

• PH_JAVA_AGENT_CUSTOM_JDBC_CONN_ERROR

• PH_JAVA_AGENT_CUSTOM_JDBC_EXEC_ERROR

• PH_JAVA_AGENT_DISCOVERY_TEST_ERROR

• PH_JAVA_AGENT_ERROR

• PH_JAVA_AGENT_GLASSFISH_MONITOR_ERROR

• PH_JAVA_AGENT_GLASS_FISH_WARNING

• PH_JAVA_AGENT_GOOGLEAPPS_EXEC_ERROR

• PH_JAVA_AGENT_IBMDB2_AUDIT_CONN_ERROR

• PH_JAVA_AGENT_IBMDB2_AUDIT_EXEC_ERROR

• PH_JAVA_AGENT_IBM_DB2_CAT_READ_ERROR

• PH_JAVA_AGENT_IBM_DB2_CONN_ERROR

• PH_JAVA_AGENT_IBM_DB2_INTERNAL_ERROR

• PH_JAVA_AGENT_INFO

• PH_JAVA_AGENT_JBOSS_CONN_ERROR

• PH_JAVA_AGENT_JBOSS_EXEC_ERROR

• PH_JAVA_AGENT_JBOSS_MONITOR_ERROR

• PH_JAVA_AGENT_JDBC_PULL_UNSUPP_ERROR

• PH_JAVA_AGENT_JDBC_SQL_NOT_SUPPORT_ERROR

• PH_JAVA_AGENT_JMX_CONN_ERROR

• PH_JAVA_AGENT_JMX_EXEC_ERROR

• PH_JAVA_AGENT_JOB_EXECUTOR_ERROR

• PH_JAVA_AGENT_JOB_STATUS_UPLOAD_ERROR

• PH_JAVA_AGENT_JOB_TYPE_ERROR

• PH_JAVA_AGENT_JOB_XML_LOAD_ERROR

• PH_JAVA_AGENT_JOB_XML_PARSE_ERROR

• PH_JAVA_AGENT_MCAFEE_MYSQL_MONITOR_ERROR

• PH_JAVA_AGENT_MCAFEE_VULN_SCANNER_ERROR

• PH_JAVA_AGENT_MONITOR_GEN_ERROR

• PH_JAVA_AGENT_MONITOR_TIMEOUT_ERROR

• PH_JAVA_AGENT_MSSQL_DDL_CONN_ERROR

• PH_JAVA_AGENT_MSSQL_LOGON_CONN_ERROR

• PH_JAVA_AGENT_MSSQL_LOGON_EXEC_ERROR

• PH_JAVA_AGENT_MSSQL_MONITOR_ERROR

• PH_JAVA_AGENT_MSSQL_PERF_CONN_ERROR

• PH_JAVA_AGENT_MSSQL_PERF_EXECUTE_ERROR

• PH_JAVA_AGENT_MYSQL_PERF_CONN_ERROR

• PH_JAVA_AGENT_MYSQL_PERF_EXEC_ERROR

• PH_JAVA_AGENT_NESSUS_REPORT_PARSE_ERROR

• PH_JAVA_AGENT_ORACLE_DB_ERROR

• PH_JAVA_AGENT_ORADB_AUDIT_CONN_ERROR

• PH_JAVA_AGENT_ORADB_AUDIT_EXEC_ERROR

• PH_JAVA_AGENT_ORADB_LOGON_EXEC_ERROR

• PH_JAVA_AGENT_ORADB_PERF_CONN_ERROR

• PH_JAVA_AGENT_ORADB_PERF_EXEC_ERROR

• PH_JAVA_AGENT_SNORT_CONN_ERROR

• PH_JAVA_AGENT_SNORT_EVENTID_ERROR

• PH_JAVA_AGENT_SNORT_EXEC_ERROR

• PH_JAVA_AGENT_SNORT_SENSORID_ERROR

EventType: PH_DEV_MON_NUTANIX_CLUSTER_STATUS

Description: Nutanix Cluster Status

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostName	Host Name	string	This is the hostname of the device of interest in the event
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
cluster	Cluster	string
clusterVersion	Cluster Version	string
clusterStatus	Cluster Status	string
diskUtil	Disk Capacity Util	double
totalDiskMB	Total Disk MB	uint32
usedDiskMB	Used Disk MB	uint32
diskRWReqPerSec	Disk RW Rate req/sec	double
devDiskRWLatency	Disk Read/Write Latency	double

EventType: PH_DEV_MON_NUTANIX_CONTAINER_INFO

Description: Nutanix Storage Container Info

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostName	Host Name	string	This is the hostname of the device of interest in the event
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
cluster	Cluster	string
ntxContainerId	Nutanix Container Id	uint64
ntxContainerName	Nutanix Container Name	string
diskUtil	Disk Capacity Util	double
totalDiskMB	Total Disk MB	uint32
usedDiskMB	Used Disk MB	uint32
diskRWReqPerSec	Disk RW Rate req/sec	double
devDiskRWLatency	Disk Read/Write Latency	double

EventType: PH_DEV_MON_NUTANIX_CTRLR_VM_RESOURCE

Description: Nutanix Controller VM Resource Info

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostName	Host Name	string	This is the hostname of the device of interest in the event
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
ntxControllerVMId	Nutanix Controller VM Id	uint64
memTotalMB	Total Memory MB	uint32
procCount	System Process Count	uint32

EventType: PH_DEV_MON_NUTANIX_DISK_STATUS

Description: Nutainix Disk Status

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostName	Host Name	string	This is the hostname of the device of interest in the event
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
cluster	Cluster	string
diskId	Disk Id	uint64
ntxControllerVMId	Nutanix Controller VM Id	uint64
hwDiskSerial	Disk Serial	string
diskUtil	Disk Capacity Util	double
totalDiskMB	Total Disk MB	uint32
freeDiskMBNonRoot	Free Disk MB NonRoot	uint32
inodeUsedPct	Inode Util	double
inodeMax	Max Inodes	uint32
inodeFreeNonRoot	Free Inodes NonRoot	uint32

EventType: PH_DEV_MON_NUTANIX_DISK_TEMP

Description: Nutanix Disk temperature event

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostName	Host Name	string	This is the hostname of the device of interest in the event
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
diskId	Disk Id	uint64
ntxControllerVMId	Nutanix Controller VM Id	uint64
hwDiskSerial	Disk Serial	string
envTempdDegC	Temperature Celsius Detailed	double

EventType: PH_DEV_MON_NUTANIX_SERVICE_STATUS

Description: Nutanix Service Status

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostName	Host Name	string	This is the hostname of the device of interest in the event
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
cluster	Cluster	string
ntxControllerVMId	Nutanix Controller VM Id	uint64
ntxClusterVMStatus	Cluster VM Status	string
ntxZeusStatus	Nutanix Zeus Status	string
ntxStargateStatus	Nutanix Stargate Status	string

EventType: PH_DEV_MON_NUTANIX_STORAGE_POOL_INFO

Description: Nutanix Storage Pool Info

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostName	Host Name	string	This is the hostname of the device of interest in the event
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
cluster	Cluster	string
spoolId	Storage Pool Id	uint64
spoolName	Storage Pool Name	string
diskUtil	Disk Capacity Util	double
totalDiskMB	Total Disk MB	uint32
usedDiskMB	Used Disk MB	uint32
diskRWReqPerSec	Disk RW Rate req/sec	double
devDiskRWLatency	Disk Read/Write Latency	double

EventType: PH_DEV_MON_OMI_PING_STAT

Description: OMI Ping Statistics

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostName	Host Name	string	This is the hostname of the device of interest in the event
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
avgDurationMSec	Avg Round Trip Time	uint32	This attribute represents Average Round Trip Time in msec. Typically used in Ping monitoring.
minDurationMSec	Min Round Trip Time	uint32	This attribute represents Minimum Round Trip Time in msec. Typically used in Ping mo itoring.
maxDurationMSec	Max Round Trip Time	uint32	This attribute represents Maximum Round Trip Time in msec. Typically used in Ping monitoring.
pktLossPct	Packet Loss Pct	double	Ratio of lost packets to the total number of sent packets. Mostly set by ping monitoring.
sysDownTime	System Downtime	uint32
sysDegradedTime	System Degraded Time	uint32
pollIntv	Polling Interval	uint32

EventType: PH_DEV_MON_OSPF_NBR_STATUS

Description: OSPF neighbor status

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
srcName	Source Host Name	string	Source device's hostname as identified in the log, can also be enriched using reverse lookup of the source IP address.
srcIpAddr	Source IP	IP	Source IP of a device as identified in the event.
destName	Destination Host Name	string	Destination device's hostname as identified in the log, can also be enriched using reverse lookup of the destination IP address.
destIpAddr	Destination IP	IP	Destination IP of a device as identified in the event.
ospfAreaId	OSPF Area Id	uint32
ospfState	OSPF State	string

EventType: PH_DEV_MON_PANASONIC_AERO_LOG_MON_STATUS

Description: Panasonic Aero Log Monitoring Status

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
phCustId	Organization ID	uint32	This is the FortiSIEM organization ID unique to each tenant
customer	Organization Name	string	This is the FortiSIEM Organization Name, which is unique to each tenant. It identifies the tenant this event belongs to.
collectorId	Collector ID	uint32	This field captures the ID of a FortiSIEM Collector
phCollectorName	Collector Name	string	Name of the FortiSIEM Collector. The name is set in GUI.
reptDevName	Reporting Device	string	This is the hostname of the device that originated the log or event packet.
airlineName	Airline Name	string
airlineTail	Airline Tail Number	string
airlineDevName	Airline Device	string
filePath	File Path	string
scannedFiles	Scanned File Count	uint32
totEventCount	Total Event Count	uint32

EventType: PH_DEV_MON_PERFMON_ALL_DEVICE_DELAY_HIGH

Description: Performance monitoring delay for all devices from a collection point crossed high water mark

Severity: 9 (High)

Event Category: 3 (System Logs)

EventType: PH_DEV_MON_PERFMON_ALL_DEVICE_DELAY_LOW

Description: Performance monitoring delay for all devices from a collection point fell below low water mark

Severity: 1 (Low)

Event Category: 3 (System Logs)

EventType: PH_DEV_MON_PERFMON_DEVICE_DELAY_HIGH

Description: All performance metrics delay for a single device crossed high water mark

Severity: 9 (High)

Event Category: 3 (System Logs)

EventType: PH_DEV_MON_PERFMON_DEVICE_DELAY_LOW

Description: Some performance metric delay for a single device fell below water mark

Severity: 1 (Low)

Event Category: 3 (System Logs)

EventType: PH_DEV_MON_PERFMON_JOB_DELAY_HIGH

Description: A performance metric delay for a single device crossed high water mark

Severity: 9 (High)

Event Category: 3 (System Logs)

EventType: PH_DEV_MON_PERFMON_JOB_DELAY_LOW

Description: A performance metric delay for a single device fell below water mark

Severity: 1 (Low)

Event Category: 3 (System Logs)

EventType: PH_DEV_MON_PERF_MSSQL_BACKUP_INFO

Description: Last backup info on SQL Server

Severity: 1 (Low)

Event Category: 3 (System Logs)

EventType: PH_DEV_MON_PERF_MSSQL_BLOCKBY_INFO

Description: Blocked process in SQL Server

Severity: 1 (Low)

Event Category: 3 (System Logs)

EventType: PH_DEV_MON_PERF_MSSQL_CONFIG_INFO

Description: SQL Server configuration

Severity: 1 (Low)

Event Category: 3 (System Logs)

EventType: PH_DEV_MON_PERF_MSSQL_ERROR_LOG_INFO

Description: SQL Server error log information

Severity: 1 (Low)

Event Category: 3 (System Logs)

EventType: PH_DEV_MON_PERF_MSSQL_GEN_INFO

Description: SQL Server general information

Severity: 1 (Low)

Event Category: 3 (System Logs)

EventType: PH_DEV_MON_PERF_MSSQL_LOCK_INFO

Description: SQL Server lock information

Severity: 1 (Low)

Event Category: 3 (System Logs)

EventType: PH_DEV_MON_PERF_MSSQL_PERDB

Description: Metrics for per database in SQL Server

Severity: 1 (Low)

Event Category: 3 (System Logs)

EventType: PH_DEV_MON_PERF_MSSQL_SYS

Description: Metrics for the total SQL Server

Severity: 1 (Low)

Event Category: 3 (System Logs)

EventType: PH_DEV_MON_PERF_MSSQL_TOP_QUERIES

Description: Top queries against SQL Server database

Severity: 1 (Low)

Event Category: 3 (System Logs)

EventType: PH_DEV_MON_PERF_MYSQLDB

Description: MySQL database performance metrics

Severity: 1 (Low)

Event Category: 3 (System Logs)

EventType: PH_DEV_MON_PERF_MYSQLDB_TABLESPACE

Description: MySQL tablespace metrics

Severity: 1 (Low)

Event Category: 3 (System Logs)

EventType: PH_DEV_MON_PERF_ORADB

Description: Oracle database performance metrics

Severity: 1 (Low)

Event Category: 3 (System Logs)

EventType: PH_DEV_MON_PERF_ORADB_CLUSTER

Description: Oracle Cluster performance metrics

Severity: 1 (Low)

Event Category: 3 (System Logs)

EventType: PH_DEV_MON_PERF_ORADB_TABLESPACE

Description: Oracle tablespace metrics

Severity: 1 (Low)

Event Category: 3 (System Logs)

EventType: PH_DEV_MON_PERF_ORADB_TOP_QUERIES

Description: Top queries against Oracle database

Severity: 1 (Low)

Event Category: 3 (System Logs)

EventType: PH_DEV_MON_PING_STAT

Description: Ping Statistics

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostName	Host Name	string	This is the hostname of the device of interest in the event
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
avgDurationMSec	Avg Round Trip Time	uint32	This attribute represents Average Round Trip Time in msec. Typically used in Ping monitoring.
minDurationMSec	Min Round Trip Time	uint32	This attribute represents Minimum Round Trip Time in msec. Typically used in Ping mo itoring.
maxDurationMSec	Max Round Trip Time	uint32	This attribute represents Maximum Round Trip Time in msec. Typically used in Ping monitoring.
pktLossPct	Packet Loss Pct	double	Ratio of lost packets to the total number of sent packets. Mostly set by ping monitoring.
sysDownTime	System Downtime	uint32
sysDegradedTime	System Degraded Time	uint32
pollIntv	Polling Interval	uint32
phCustId	Organization ID	uint32	This is the FortiSIEM organization ID unique to each tenant

EventType: PH_DEV_MON_PING_STAT_SUPPRESSED

Description: Ping stat suppressed

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostName	Host Name	string	This is the hostname of the device of interest in the event
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
avgDurationMSec	Avg Round Trip Time	uint32	This attribute represents Average Round Trip Time in msec. Typically used in Ping monitoring.
minDurationMSec	Min Round Trip Time	uint32	This attribute represents Minimum Round Trip Time in msec. Typically used in Ping mo itoring.
maxDurationMSec	Max Round Trip Time	uint32	This attribute represents Maximum Round Trip Time in msec. Typically used in Ping monitoring.
pktLossPct	Packet Loss Pct	double	Ratio of lost packets to the total number of sent packets. Mostly set by ping monitoring.

EventType: PH_DEV_MON_PORT_CLOSE

Description: A port is closed

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostName	Host Name	string	This is the hostname of the device of interest in the event
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
serviceName	Service Name	string
ipProto	IP Protocol	uint16	IP Protocol, e.g. TCP, UDP, ICMP etc as defined in IP RFPs
ipPort	IP Port	uint16	IP port number
pollIntv	Polling Interval	uint32

EventType: PH_DEV_MON_PORT_OPEN

Description: A new port is open

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostName	Host Name	string	This is the hostname of the device of interest in the event
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
serviceName	Service Name	string
ipProto	IP Protocol	uint16	IP Protocol, e.g. TCP, UDP, ICMP etc as defined in IP RFPs
ipPort	IP Port	uint16	IP port number
pollIntv	Polling Interval	uint32

EventType: PH_DEV_MON_PRINTER_OUTPUT_STATUS

Description: Printer Output Status

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostName	Host Name	string	This is the hostname of the device of interest in the event
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
prtDevStatus	Printer Device Status	string
prtPrintStatus	Printer Printing Status	string
prtErrorState	Printer Error State	string
prtPrintPageCount	Printed Page Count	uint32

EventType: PH_DEV_MON_PRINTER_SUPPLY_STATUS

Description: Printer Supply Status

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostName	Host Name	string	This is the hostname of the device of interest in the event
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
prtSupplyType	Printer Supply Type	string
prtSupplyName	Printer Supply Name	string
prtMaxSupplyLevel	Printer Max Supply Level	int32
prtCurrSupplyLevel	Printer Current Supply Level	int32
prtSupplyUnit	Printer Supply Unit	string
prtCurrSupplyUsedPct	Printer Pct Used Supply	double

EventType: PH_DEV_MON_PROC_CPU_UTIL

Description: Process CPU Utilization stats

Severity: 1 (Low)

Event Category: 3 (System Logs)

EventType: PH_DEV_MON_PROC_MEM_UTIL

Description: Process Memory Utilization

Severity: 1 (Low)

Event Category: 3 (System Logs)

EventType: PH_DEV_MON_PROC_RESOURCE_UTIL

Description: Process CPU and Memory Utilization stats

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
swProcName	Software Name	string
hostName	Host Name	string	This is the hostname of the device of interest in the event
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
procOwner	Process Owner	string
memUtil	Memory Util	double
cpuUtil	CPU Util	double
appName	Application Name	string
appGroupName	Application Group Name	string
pollIntv	Polling Interval	uint32
swParam	Software Param	string
realMemPeakKBytes	Real Peak Memory KB	uint32
virtMemKBytes	Virtual Memory KB	uint32
peakVirtMemKBytes	Peak Virtual Memory KB	uint32
diskReadKBytesPerSec	Disk Read Rate KBps	double
diskWriteKBytesPerSec	Disk Write Rate KBps	double
sysUpTime	System Uptime	uint32

EventType: PH_DEV_MON_PROC_START

Description: Process Started

Severity: 5 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
swProcName	Software Name	string
hostName	Host Name	string	This is the hostname of the device of interest in the event
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
procOwner	Process Owner	string
appName	Application Name	string
appGroupName	Application Group Name	string
pollIntv	Polling Interval	uint32
swParam	Software Param	string

EventType: PH_DEV_MON_PROC_STOP

Description: Process Stopped

Severity: 9 (High)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
swProcName	Software Name	string
hostName	Host Name	string	This is the hostname of the device of interest in the event
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
procOwner	Process Owner	string
appName	Application Name	string
appGroupName	Application Group Name	string
pollIntv	Polling Interval	uint32
swParam	Software Param	string

EventType: PH_DEV_MON_QUALYS_WEB_APP_FW

Description: Qualys Web Application Firewall Log

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
eventTime	Event Occur Time	Date
srcIpAddr	Source IP	IP	Source IP of a device as identified in the event.
srcIpPort	Source TCP/UDP Port	uint16	This is the source TCP or UDP port as identified in the event
type	Type	string
ipsConfidence	Attack Confidence	string
policyName	Policy Name	string
msg	Message	string

EventType: PH_DEV_MON_RBD_BW

Description: Riverbed Steelhead appliance bandwidth metrics

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostName	Host Name	string	This is the hostname of the device of interest in the event
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
inLanBytes	Inbound Optimized Bytes LAN Side	uint32
inWanBytes	Inbound Optimized Bytes WAN Side	uint32
outLanBytes	Outbound Optimized Bytes LAN Side	uint32
outWanBytes	Outbound Optimized Bytes WAN Side	uint32

EventType: PH_DEV_MON_RBD_CONN

Description: Riverbed Steelhead appliance connection metrics

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostName	Host Name	string	This is the hostname of the device of interest in the event
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
optConn	Optimized Connections	uint32
passthruOptConn	Passthrough Connections	uint32
halfOpenOptConn	Half-open Optimized Connections	uint32
halfClosedOptConn	Half-closed Optimized Connections	uint32
estOptConn	Established Optimized Connections	uint32
activeOptConn	Active Optimized Connections	uint32
totalOptConn	Total Opt Connections	uint32

EventType: PH_DEV_MON_RBD_PEER_STAT

Description: Riverbed Steelhead appliance Peer metrics

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostName	Host Name	string	This is the hostname of the device of interest in the event
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
destIpAddr	Destination IP	IP	Destination IP of a device as identified in the event.
rbdState	Riverbed Steelhead State	string
connFailure	Connection Failures	uint32
reqTimeout	Request Timeout	uint32
maxLatency	Max Latency	double

EventType: PH_DEV_MON_RBD_PER_PORT_BW

Description: Riverbed Steelhead per port bandwidth metrics

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostName	Host Name	string	This is the hostname of the device of interest in the event
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
destIpPort	Destination TCP/UDP Port	uint16	This is the destination TCP or UDP port as identified in the event
inLanBytes	Inbound Optimized Bytes LAN Side	uint32
inWanBytes	Inbound Optimized Bytes WAN Side	uint32
outLanBytes	Outbound Optimized Bytes LAN Side	uint32
outWanBytes	Outbound Optimized Bytes WAN Side	uint32

EventType: PH_DEV_MON_RBD_TOP_APP

Description: Riverbed Steelhead appliance top application metrics

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostName	Host Name	string	This is the hostname of the device of interest in the event
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
destIpPort	Destination TCP/UDP Port	uint16	This is the destination TCP or UDP port as identified in the event
totBytes64	Total Bytes64	uint64	Total number of sent and received bytes by a host. This has 64bit resolution.

EventType: PH_DEV_MON_RBD_TOP_DEST

Description: Riverbed Steelhead appliance top dest metrics

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostName	Host Name	string	This is the hostname of the device of interest in the event
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
destIpAddr	Destination IP	IP	Destination IP of a device as identified in the event.
totBytes64	Total Bytes64	uint64	Total number of sent and received bytes by a host. This has 64bit resolution.

EventType: PH_DEV_MON_RBD_TOP_SRC

Description: Riverbed Steelhead appliance top src metrics

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostName	Host Name	string	This is the hostname of the device of interest in the event
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
srcIpAddr	Source IP	IP	Source IP of a device as identified in the event.
totBytes64	Total Bytes64	uint64	Total number of sent and received bytes by a host. This has 64bit resolution.

EventType: PH_DEV_MON_RBD_TOP_TALKER

Description: Riverbed Steelhead appliance top talker metrics

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostName	Host Name	string	This is the hostname of the device of interest in the event
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
srcIpAddr	Source IP	IP	Source IP of a device as identified in the event.
srcIpPort	Source TCP/UDP Port	uint16	This is the source TCP or UDP port as identified in the event
destIpAddr	Destination IP	IP	Destination IP of a device as identified in the event.
destIpPort	Destination TCP/UDP Port	uint16	This is the destination TCP or UDP port as identified in the event
totBytes64	Total Bytes64	uint64	Total number of sent and received bytes by a host. This has 64bit resolution.

EventType: PH_DEV_MON_RDS_METRIC

Description: AWS RDS metrics

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
phCustId	Organization ID	uint32	This is the FortiSIEM organization ID unique to each tenant
hostName	Host Name	string	This is the hostname of the device of interest in the event
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
instanceName	DB Instance Name	string
type	Type	string
dbCpuTimeRatio	DB CPU Time Ratio	double
dbUserConn	DB User Connections	uint32
diskQLen	Disk Queue Length	uint32
freeMemKB	Free Memory	uint32
freeDiskMB	Free Disk MB	uint32
usedSwapMemKB	Used Swap Memory	uint32
ioReadsPerSec	Total Read I/Os Rate	double
ioWritesPerSec	Total Write I/Os Rate	double
devDiskRdLatency	Disk Read Latency ms	double
devDiskWrLatency	Disk Write Latency ms	double

EventType: PH_DEV_MON_RUCKUS_ACCESS_POINT_STAT

Description: Ruckus Access Point Statistics

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostName	Host Name	string	This is the hostname of the device of interest in the event
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
description	Description	string
numRadio	Radio Count	uint32
numWlanClient	WLAN Station Count	uint32	WLAN Station Count found in SNMP based WLAN monitoring
knownRogueAP	Known Rogue APs	uint32
connMode	Connection Mode	string
firstJoinTime	First Join Time	Date
lastBootTime	Last Boot Time	Date
lastUpgradeTime	Last Upgrade Time	Date
sentBytes64	Sent Bytes64	uint64	Number of bytes sent by a host. This has 64bit resolution.
recvBytes64	Received Bytes64	uint64	Number of bytes received by a host. This has 64bit resolution.
sentBitsPerSec	Sent Bit Rate	double
recvBitsPerSec	Received Bit Rate	double

EventType: PH_DEV_MON_RUCKUS_CONTROLLER_STAT

Description: Ruckus Controller Statistics

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostName	Host Name	string	This is the hostname of the device of interest in the event
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
numAp	AP Count	uint32
numWlanClient	WLAN Station Count	uint32	WLAN Station Count found in SNMP based WLAN monitoring
newRogueAP	New Rogue APs	uint32
knownRogueAP	Known Rogue APs	uint32
wlanSentBytes	WLAN Sent Bytes	uint64	WLAN Sent Bytes found in SNMP based WLAN monitoring
wlanRecvBytes	WLAN Recv Bytes	uint64	WLAN Recv Bytes found in SNMP based WLAN monitoring
wlanSentBitsPerSec	WLAN Sent Rate bps	double	WLAN Sent Rate (in bits/sec) found in SNMP based WLAN monitoring
wlanRecvBitsPerSec	WLAN Recv Rate bps	double	WLAN Recv Rate (in bits/sec)s found in SNMP based WLAN monitoring
lanSentBytes	LAN Sent Bytes	uint64
lanRecvBytes	LAN Recv Bytes	uint64
lanSentBitsPerSec	LAN Sent Rate bps	double

EventType: PH_DEV_MON_RUCKUS_SSID_PERF

Description: Ruckus SSID Performance Metrics

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostName	Host Name	string	This is the hostname of the device of interest in the event
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
wlanSsid	WLAN SSID	string	WLAN Service Set Identifier (SSID) found in SNMP based WLAN monitoring
description	Description	string
wlanName	WLAN Name	string	WLAN Name found in SNMP based WLAN monitoring
authenMethod	Authentication Method	string
encryptAlgo	Encryption Algorithm	string
isGuest	Guest VLAN	string
srcVLAN	Source VLAN	uint16	The VLAN to which the Source Network Interface belongs. Source network interface through which a packet enters a network device.
sentBytes64	Sent Bytes64	uint64	Number of bytes sent by a host. This has 64bit resolution.
recvBytes64	Received Bytes64	uint64	Number of bytes received by a host. This has 64bit resolution.
sentBitsPerSec	Sent Bit Rate	double
recvBitsPerSec	Received Bit Rate	double
authSuccess	Auth Successes	uint32
authFailure	Auth Failures	uint32
assocSuccess	Assoc Success	uint32
assocFailure	Assoc Failure	uint32
assocDeny	Assoc Deny	uint32
disassocAbnormal	Disassoc Abnormal	uint32
disassocLeave	Disassoc Leave	uint32
disassocMisc	Disassoc Misc	uint32

EventType: PH_DEV_MON_SERVERIRON_REAL_SERVER_STAT

Description: Brocade ServerIron ADX Real Server Stat

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostName	Host Name	string	This is the hostname of the device of interest in the event
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
realServerIP	Real Server IP	IP
realServerState	Real Server State	string
failedPortExists	Failed Port Exists	uint16
openConnectionsCount	Open Connections	uint64
peakConns	Peak Connections	uint64
activeSessions	Active Sessions	uint64

EventType: PH_DEV_MON_SLB_METRIC

Description: Cisco Server Load Balancing metrics

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostName	Host Name	string	This is the hostname of the device of interest in the event
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
lbOpenConn	LB Open Conn	uint32
lbFailedConn	LB Failed Conn	uint32
lbL4Conn	LB L4 Conn	uint32
lbL7Conn	LB L7 Conn	uint32
lbDroppedL4Conn	LB Dropped L4 Conn	uint32
lbDroppedL7Conn	LB Dropped L7 Conn	uint32
lbHttpRedirectConn	LB HTTP Redirect Conn	uint32
lbDroppedHttpRedirectConn	LB Dropped HTTP Redirect Conn	uint32
lbAclDeniedConn	LB ACL Denied Conn	uint32
lbTimedoutConn	LB Timed Out Conn	uint32

EventType: PH_DEV_MON_SNMP_PING_STAT

Description: SNMP Ping Statistics

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostName	Host Name	string	This is the hostname of the device of interest in the event
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
avgDurationMSec	Avg Round Trip Time	uint32	This attribute represents Average Round Trip Time in msec. Typically used in Ping monitoring.
minDurationMSec	Min Round Trip Time	uint32	This attribute represents Minimum Round Trip Time in msec. Typically used in Ping mo itoring.
maxDurationMSec	Max Round Trip Time	uint32	This attribute represents Maximum Round Trip Time in msec. Typically used in Ping monitoring.
pktLossPct	Packet Loss Pct	double	Ratio of lost packets to the total number of sent packets. Mostly set by ping monitoring.
sysDownTime	System Downtime	uint32
sysDegradedTime	System Degraded Time	uint32
pollIntv	Polling Interval	uint32

EventType: PH_DEV_MON_SRC_AD_REPL_STAT

Description: Windows Active Directory Source REPLSTAT command output

Severity: 1 (Low)

Event Category: 3 (System Logs)

EventType: PH_DEV_MON_STATUS

Description: Status of devices monitored by FortiSIEM

Severity: 1 (Low)

Event Category: 3 (System Logs)

EventType: PH_DEV_MON_STORAGE_PORT_DOWN_TO_UP

Description: Storage port came back up

Severity: 7 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostName	Host Name	string	This is the hostname of the device of interest in the event
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
spName	SAN Storage Processor Name	string
spPortName	SAN Storage Port Name	string
srcName	Source Host Name	string	Source device's hostname as identified in the log, can also be enriched using reverse lookup of the source IP address.

EventType: PH_DEV_MON_STORAGE_PORT_UP_TO_DOWN

Description: Storage port went down

Severity: 8 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostName	Host Name	string	This is the hostname of the device of interest in the event
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
spName	SAN Storage Processor Name	string
spPortName	SAN Storage Port Name	string
srcName	Source Host Name	string	Source device's hostname as identified in the log, can also be enriched using reverse lookup of the source IP address.

EventType: PH_DEV_MON_SYS_CPU_UTIL

Description: System CPU Utilization for a device

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
cpuName	CPU Name	string
hostName	Host Name	string	This is the hostname of the device of interest in the event
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
cpuUtil	CPU Util	double
pollIntv	Polling Interval	uint32
sysCpuUtil	System CPU Util	double
userCpuUtil	User CPU Util	double
waitCpuUtil	Wait CPU Util	double
kernCpuUtil	Kernel CPU Util	double
contextSwitchPerSec	Context Switch Rate /sec	double
cpuInterruptPerSec	CPU Interrupt Rate /sec	double
cpuCore	CPU Cores	uint16
loadAvg1min	Load Average 1 min	double	Linux Server load average (calculated over 1min ntervals). Linux load average is a metric that shows the number of tasks currently executed by the CPU and tasks waiting in the queue.
loadAvg5min	Load Average 5 min	double	Linux Server load average (calculated over 5min ntervals). Linux load average is a metric that shows the number of tasks currently executed by the CPU and tasks waiting in the queue.
loadAvg15min	Load Average 15 min	double	Linux Server load average (calculated over 15min ntervals). Linux load average is a metric that shows the number of tasks currently executed by the CPU and tasks waiting in the queue.
relayDevIpAddr	Relaying IP	IP	Relaying IP is most commonly used to specify the log relay appliance, usually a collector.
relayDevName	Relaying Device	string	This is the hostname of the relaying device, a log relay, which is most typically a FortiSIEM collector.

EventType: PH_DEV_MON_SYS_DISK_FREE

Description: Free disk space stats for a device

Severity: 1 (Low)

Event Category: 3 (System Logs)

EventType: PH_DEV_MON_SYS_DISK_TREND_DAY

Description: Daily Disk growth trend

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostName	Host Name	string	This is the hostname of the device of interest in the event
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
diskName	Disk Name	string
totalDiskMB	Total Disk MB	uint32
usedDiskMB	Used Disk MB	uint32
freeDiskMB	Free Disk MB	uint32
diskUtil	Disk Capacity Util	double
diskGrowthMBDaily	Current Daily Disk Growth	double
avgDiskGrowthMBDaily	Avg Daily Disk Growth	double
timeToDiskFull	Days To Disk Full	int32

EventType: PH_DEV_MON_SYS_DISK_TREND_MONTH

Description: Monthly disk growth trend

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostName	Host Name	string	This is the hostname of the device of interest in the event
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
diskName	Disk Name	string
totalDiskMB	Total Disk MB	uint32
usedDiskMB	Used Disk MB	uint32
freeDiskMB	Free Disk MB	uint32
diskUtil	Disk Capacity Util	double
diskGrowthMBMonthly	Current Monthly Disk Growth	double
avgDiskGrowthMBMonthly	Avg Monthly Disk Growth	double
timeToDiskFull	Days To Disk Full	int32

EventType: PH_DEV_MON_SYS_DISK_TREND_WEEK

Description: Weekly disk growth trend

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostName	Host Name	string	This is the hostname of the device of interest in the event
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
diskName	Disk Name	string
totalDiskMB	Total Disk MB	uint32
usedDiskMB	Used Disk MB	uint32
freeDiskMB	Free Disk MB	uint32
diskUtil	Disk Capacity Util	double
diskGrowthMBWeekly	Current Weekly Disk Growth	double
avgDiskGrowthMBWeekly	Avg Weekly Disk Growth	double
timeToDiskFull	Days To Disk Full	int32

EventType: PH_DEV_MON_SYS_DISK_UTIL

Description: Disk Utilization stats for a device

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
diskName	Disk Name	string
hostName	Host Name	string	This is the hostname of the device of interest in the event
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
diskUtil	Disk Capacity Util	double
totalDiskMB	Total Disk MB	uint32
usedDiskMB	Used Disk MB	uint32
freeDiskMB	Free Disk MB	uint32
pollIntv	Polling Interval	uint32
inodeUsedPct	Inode Util	double
inodeUsed	Used Inodes	uint32
inodeFree	Free Inodes	uint32
inodeMax	Max Inodes	uint32
fileUsedPct	File Util	double
fileUsed	Used Files	uint32
fileFree	Free Files	uint32
fileMax	Max Files	uint32
maxDiskUtil	Max Disk Util	double
maxInodeUsedPct	Max Inode Util	double
maxFileUsedPct	Max File Util	double
appTransportProto	Application Protocol	string
resvDiskMB	Reserved Disk MB	uint32
availDiskMB	Available Disk MB	uint32

EventType: PH_DEV_MON_SYS_EXT_CMD

Description: Extensible commands status

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostName	Host Name	string	This is the hostname of the device of interest in the event
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
appName	Application Name	string
command	Command	string
exitValue	Command exit value	int32
usrMsg	User defined msg	string
extCmdErrStatus	Extensible Command Error Status	string
errFixCmd	Error Fix Command	string

EventType: PH_DEV_MON_SYS_MEM_FREE

Description: Free system memory stats for a device

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
memName	Memory Name	string
hostName	Host Name	string	This is the hostname of the device of interest in the event
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
freeMemKB	Free Memory	uint32
pollIntv	Polling Interval	uint32

EventType: PH_DEV_MON_SYS_MEM_UTIL

Description: System memory Utilization stats for a device

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
memName	Memory Name	string
hostName	Host Name	string	This is the hostname of the device of interest in the event
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
memUtil	Memory Util	double
pollIntv	Polling Interval	uint32
freeMemKB	Free Memory	uint32
bufMemKB	Buffer Memory	uint32
cacheMemKB	Cache Memory	uint32
swapMemUtil	Swap Memory Util	double
freeSwapMemKB	Free Swap Memory	uint32
swapInRate	Swap Read Rate Pages/sec	double
swapOutRate	Swap Write Rate Pages/sec	double
swapRate	Total Swap Rate Pages/sec	double
totalMemKB	Total Memory	uint32
usedMemKB	Used Memory	uint32
relayDevIpAddr	Relaying IP	IP	Relaying IP is most commonly used to specify the log relay appliance, usually a collector.
relayDevName	Relaying Device	string	This is the hostname of the relaying device, a log relay, which is most typically a FortiSIEM collector.

EventType: PH_DEV_MON_SYS_PAGEFILE_USAGE

Description: Pagefile usage for Windows systems

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostName	Host Name	string	This is the hostname of the device of interest in the event
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
pageFileUsage	PageFile Usage	double
pageFilePeakUsage	PageFile Peak Usage	double

EventType: PH_DEV_MON_SYS_PER_CPU_UTIL

Description: System per CPU Utilization for a device

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
cpuName	CPU Name	string
hostName	Host Name	string	This is the hostname of the device of interest in the event
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
cpuUtil	CPU Util	double
pollIntv	Polling Interval	uint32
sysCpuUtil	System CPU Util	double
userCpuUtil	User CPU Util	double

EventType: PH_DEV_MON_SYS_PROC_COUNT

Description: System process count for a device

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostName	Host Name	string	This is the hostname of the device of interest in the event
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
procCount	System Process Count	uint32
pollIntv	Polling Interval	uint32

EventType: PH_DEV_MON_SYS_RESTART

Description: A device restarted

Severity: 5 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostName	Host Name	string	This is the hostname of the device of interest in the event
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
restartTime	Restart Time	Date

EventType: PH_DEV_MON_SYS_STAT

Description: HP-UNIX logged in users and average system jobs statistics

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostName	Host Name	string	This is the hostname of the device of interest in the event
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
numUser	System Logged In User	uint32
numJob	Average System Job	uint32
pollIntv	Polling Interval	uint32

EventType: PH_DEV_MON_SYS_STATUS

Description: Overall System ststus

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostName	Host Name	string	This is the hostname of the device of interest in the event
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
overallStatusCode	Overall Health	uint16
systemStatus	System Health	string
svcStatus	Service Health	string
envTempDegC	Temperature Celsius	uint32

EventType: PH_DEV_MON_SYS_SWAP_MEM_ERROR_MSG

Description: Swap memory error

Severity: 8 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
memName	Memory Name	string
hostName	Host Name	string	This is the hostname of the device of interest in the event
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
swapMemUtil	Swap Memory Util	double
freeSwapMemKB	Free Swap Memory	uint32
memMinimumSwap	Minimum Swap Memory	uint32
swapMemErrorString	Swap Memory Error	string

EventType: PH_DEV_MON_SYS_UPTIME

Description: System uptime for a device

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostName	Host Name	string	This is the hostname of the device of interest in the event
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
sysUpTime	System Uptime	uint32
sysUpTimePct	System Uptime Pct	double
sysDownTime	System Downtime	uint32
pollIntv	Polling Interval	uint32
relayDevIpAddr	Relaying IP	IP	Relaying IP is most commonly used to specify the log relay appliance, usually a collector.
relayDevName	Relaying Device	string	This is the hostname of the relaying device, a log relay, which is most typically a FortiSIEM collector.

EventType: PH_DEV_MON_SYS_VIRT_MEM_UTIL

Description: System virtual memory Utilization stats for a device

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
memName	Memory Name	string
hostName	Host Name	string	This is the hostname of the device of interest in the event
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
virtMemUsedKB	Virtual Memory	uint32
virtMemUtil	Virtual Memory Util	double
pollIntv	Polling Interval	uint32

EventType: PH_DEV_MON_TARGET_FILE_CONTENT_CHANGE

Description: Target file hash changed from gold standard

Severity: 9 (High)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
phCustId	Organization ID	uint32	This is the FortiSIEM organization ID unique to each tenant
hostName	Host Name	string	This is the hostname of the device of interest in the event
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
fileName	File Name	string
hashCode	Hash Code	string
oldSVNVersion	Old SVN Version	uint32
newSVNVersion	New SVN Version	uint32
deletedItem	Deleted Item	string
addedItem	Added Item	string

EventType: PH_DEV_MON_TOMCAT_CPU

Description: Tomcat cpu usage metrics

Severity: 1 (Low)

Event Category: 3 (System Logs)

EventType: PH_DEV_MON_TOMCAT_DB

Description: Tomcat database pool metrics

Severity: 1 (Low)

Event Category: 3 (System Logs)

EventType: PH_DEV_MON_TOMCAT_MEMORY

Description: Tomcat memory usage metrics

Severity: 1 (Low)

Event Category: 3 (System Logs)

EventType: PH_DEV_MON_TOMCAT_REQUEST_PROCESSOR

Description: Tomcat request processor metrics

Severity: 1 (Low)

Event Category: 3 (System Logs)

EventType: PH_DEV_MON_TOMCAT_SERVLET

Description: Tomcat servlet metrics

Severity: 1 (Low)

Event Category: 3 (System Logs)

EventType: PH_DEV_MON_TOMCAT_SESSION

Description: Tomcat session metrics

Severity: 1 (Low)

Event Category: 3 (System Logs)

EventType: PH_DEV_MON_TOMCAT_THREAD_POOL

Description: Tomcat thread pool usage metrics

Severity: 1 (Low)

Event Category: 3 (System Logs)

EventType: PH_DEV_MON_TRACEROUTE_STAT

Description: Trace Route statistics

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
eventTime	Event Occur Time	Date
jobId	Job Id	string
srcIpAddr	Source IP	IP	Source IP of a device as identified in the event.
srcName	Source Host Name	string	Source device's hostname as identified in the log, can also be enriched using reverse lookup of the source IP address.
destIpAddr	Destination IP	IP	Destination IP of a device as identified in the event.
destName	Destination Host Name	string	Destination device's hostname as identified in the log, can also be enriched using reverse lookup of the destination IP address.
hopNum	Hop Count	uint32
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
hostName	Host Name	string	This is the hostname of the device of interest in the event
minDurationMSec	Min Round Trip Time	uint32	This attribute represents Minimum Round Trip Time in msec. Typically used in Ping mo itoring.
maxDurationMSec	Max Round Trip Time	uint32	This attribute represents Maximum Round Trip Time in msec. Typically used in Ping monitoring.
avgDurationMSec	Avg Round Trip Time	uint32	This attribute represents Average Round Trip Time in msec. Typically used in Ping monitoring.
pktLossPct	Packet Loss Pct	double	Ratio of lost packets to the total number of sent packets. Mostly set by ping monitoring.

EventType: PH_DEV_MON_UCS_HW_CHASSIS_STAT

Description: Cisco UCS Chassis status

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostName	Host Name	string	This is the hostname of the device of interest in the event
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
hwComponentName	Hardware Component Name	string	This field represents the hardware component that has an issue when the hardware status is Warning or Critcal. For example when hwDiskStatus is 2 (Critical), this field states which disk has an issue.
inputPowerWatt	Input Power Watt	double
inputPowerAvgWatt	Avg Input Power Watt	double
inputPowerMaxWatt	Max Input Power Watt	double
inputPowerMinWatt	Min Input Power Watt	double
outputPowerWatt	Output Power Watt	double
outputPowerAvgWatt	Avg Output Power Watt	double
outputPowerMaxWatt	Max Output Power Watt	double
outputPowerMinWatt	Min Output Power Watt	double

EventType: PH_DEV_MON_UCS_HW_FAN_STAT

Description: Cisco UCS fan status

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostName	Host Name	string	This is the hostname of the device of interest in the event
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
hwComponentName	Hardware Component Name	string	This field represents the hardware component that has an issue when the hardware status is Warning or Critcal. For example when hwDiskStatus is 2 (Critical), this field states which disk has an issue.
fanSpeed	Fan Speed	double
fanSpeedAvg	Avg Fan Speed	double
fanSpeedMax	Max Fan Speed	double
fanSpeedMin	Min Fan Speed	double

EventType: PH_DEV_MON_UCS_HW_MEMORY_STAT

Description: Cisco UCS memory status

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostName	Host Name	string	This is the hostname of the device of interest in the event
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
hwComponentName	Hardware Component Name	string	This field represents the hardware component that has an issue when the hardware status is Warning or Critcal. For example when hwDiskStatus is 2 (Critical), this field states which disk has an issue.
envTempdDegC	Temperature Celsius Detailed	double
envTempAvgDegC	Avg Temperature Celsius	double
envTempMaxDegC	Max Temperature Celsius	double
envTempMinDegC	Min Temperature Celsius	double

EventType: PH_DEV_MON_UCS_HW_PROCESSOR_STAT

Description: Cisco UCS processor status

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostName	Host Name	string	This is the hostname of the device of interest in the event
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
hwComponentName	Hardware Component Name	string	This field represents the hardware component that has an issue when the hardware status is Warning or Critcal. For example when hwDiskStatus is 2 (Critical), this field states which disk has an issue.
inputCurrentAmp	Input Amp	double
inputCurrentAvgAmp	Avg Input Amp	double
inputCurrentMaxAmp	Max Input Amp	double
inputCurrentMinAmp	Min Input Amp	double
envTempdDegC	Temperature Celsius Detailed	double
envTempAvgDegC	Avg Temperature Celsius	double
envTempMaxDegC	Max Temperature Celsius	double
envTempMinDegC	Min Temperature Celsius	double

EventType: PH_DEV_MON_UCS_HW_PSU_STAT

Description: Cisco UCS power supply status

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostName	Host Name	string	This is the hostname of the device of interest in the event
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
hwComponentName	Hardware Component Name	string	This field represents the hardware component that has an issue when the hardware status is Warning or Critcal. For example when hwDiskStatus is 2 (Critical), this field states which disk has an issue.
envTempdDegC	Temperature Celsius Detailed	double
envTempAvgDegC	Avg Temperature Celsius	double
envTempMaxDegC	Max Temperature Celsius	double
envTempMinDegC	Min Temperature Celsius	double
input210Volt	Input 210 Volt	double
input210AvgVolt	Avg Input 210 Volt	double
input210MaxVolt	Max Input 210 Volt	double
input210MinVolt	Min Input 210 Power Volt	double
output12Volt	Output 12 Volt	double
output12AvgVolt	Avg Output Volt	double
output12MaxVolt	Max Output Volt	double
output12MinVolt	Min Output Volt	double
output3V3Volt	Output 3V3 Volt	double
output3V3AvgVolt	Avg Output 3V3 Volt	double
output3V3MaxVolt	Max Output 3V3 Volt	double
output3V3MinVolt	Min Output 3V3 Volt	double
outputCurrentAmp	Output Amp	double
outputCurrentAvgAmp	Avg Output Amp	double
outputCurrentMaxAmp	Max Output Amp	double
outputCurrentMinAmp	Min Output Amp	double
outputPowerWatt	Output Power Watt	double
outputPowerAvgWatt	Avg Output Power Watt	double
outputPowerMaxWatt	Max Output Power Watt	double
outputPowerMinWatt	Min Output Power Watt	double

EventType: PH_DEV_MON_UPS_METRIC

Description: UPS metric

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostName	Host Name	string	This is the hostname of the device of interest in the event
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
upsRemainBatteryChargePct	UPS Remaining Charge Pct	uint32
upsBatteryStatus	UPS Battery Status	uint32
upsReplaceBatteryIndicator	UPS Replace Battery Indicator	uint32
upsTimeOnBattery	UPS Time on Battery sec	uint32
upsBasicOutputStatus	UPS Output Status	uint32
upsAdvOutputLoad	UPS Output Load	uint32
upsAdvOutputVoltage	UPS Output Voltage V	uint32
upsAdvOutputFreq	UPS Output Frequency Hz	uint32
upsEstSecRemain	UPS Time Remaining sec	uint32
upsBatteryVoltage	UPS Battery Voltage	double
upsBatteryCurrent	UPS Battery Current Amp	double
upsBatteryTempC	UPS Battery Temperature Celsius	uint32
upsBatteryTempF	UPS Battery Temperature Fahrenheit	uint32
hwComponentName	Hardware Component Name	string	This field represents the hardware component that has an issue when the hardware status is Warning or Critcal. For example when hwDiskStatus is 2 (Critical), this field states which disk has an issue.
upsAdvInputFreq	UPS Input FrequencyHz	uint32
upsAdvInputVoltage	UPS Input Voltage	uint32
upsOutputCurrent	UPS Output Current	double
upsOutputPower	UPS Output Power	double

EventType: PH_DEV_MON_VMCLUSTER_CPU_UTIL

Description: Physical CPU usage for a VMware Cluster

Severity: 1 (Low)

Event Category: 3 (System Logs)

EventType: PH_DEV_MON_VMCLUSTER_DATASTORE_IO

Description: Datastore IO stats for a VMware Cluster

Severity: 1 (Low)

Event Category: 3 (System Logs)

EventType: PH_DEV_MON_VMCLUSTER_MEM_UTIL

Description: Physical memory usage for a VMware Cluster

Severity: 1 (Low)

Event Category: 3 (System Logs)

EventType: PH_DEV_MON_VMCLUSTER_STATUS

Description: VMware cluster status

Severity: 1 (Low)

Event Category: 3 (System Logs)

EventType: PH_DEV_MON_VMRESPOOL_CPU_UTIL

Description: Physical CPU usage for a VMware Resource Pool

Severity: 1 (Low)

Event Category: 3 (System Logs)

EventType: PH_DEV_MON_VMRESPOOL_MEM_UTIL

Description: Physical memory usage for a VMware Resource Pool

Severity: 1 (Low)

Event Category: 3 (System Logs)

EventType: PH_DEV_MON_VM_CPU_UTIL

Description: Physical CPU usage for a Virtual Machine

Severity: 1 (Low)

Event Category: 3 (System Logs)

EventType: PH_DEV_MON_VM_DATASTORE_IO

Description: Datastore IO stats for a Virtual Machine

Severity: 1 (Low)

Event Category: 3 (System Logs)

EventType: PH_DEV_MON_VM_DISK_IO

Description: Disk IO stats for a Virtual Machine

Severity: 1 (Low)

Event Category: 3 (System Logs)

EventType: PH_DEV_MON_VM_DISK_UTIL

Description: VM datastore utilization

Severity: 1 (Low)

Event Category: 3 (System Logs)

EventType: PH_DEV_MON_VM_MEM_UTIL

Description: Physical memory usage for a Virtual Machine

Severity: 1 (Low)

Event Category: 3 (System Logs)

EventType: PH_DEV_MON_VM_NET_INTF_UTIL

Description: Network IO stats for a Virtual Machine

Severity: 1 (Low)

Event Category: 3 (System Logs)

EventType: PH_DEV_MON_VM_PER_CPU_UTIL

Description: Physical CPU utilization for a Virtual Machine's virtual CPU

Severity: 1 (Low)

Event Category: 3 (System Logs)

EventType: PH_DEV_MON_VM_SNAPSHOT

Description: Virtual Machine Snapshot

Severity: 1 (Low)

Event Category: 3 (System Logs)

EventType: PH_DEV_MON_VM_STATE

Description: Virtual Machine State

Severity: 1 (Low)

Event Category: 3 (System Logs)

EventType: PH_DEV_MON_VM_TOOLS_STATUS

Description: VMware tools status

Severity: 1 (Low)

Event Category: 3 (System Logs)

EventType: PH_DEV_MON_VM_UPTIME

Description: Virtual Machine's up time

Severity: 1 (Low)

Event Category: 3 (System Logs)

EventType: PH_DEV_MON_VPN_CONN

Description: VPN Statistics

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostName	Host Name	string	This is the hostname of the device of interest in the event
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
vpnConnCount	VPN Conn Count	uint32

EventType: PH_DEV_MON_VPN_STATUS

Description: VPN Performance metrics

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostName	Host Name	string	This is the hostname of the device of interest in the event
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
vpnStatus	VPN Status	string
vpnConnCount	VPN Conn Count	uint32
sslVpnStatus	SSL VPN Status	string
sslVpnConnCount	SSL VPN Conn Count	uint32
vpnTunnelName	VPN Tunnel Name	string
vpnConnType	VPN Conn Type	string
remoteVpnIpAddr	Remote VPN Tunnel IP	IP
sentBitsPerSec	Sent Bit Rate	double
recvBitsPerSec	Received Bit Rate	double
sentBytes64	Sent Bytes64	uint64	Number of bytes sent by a host. This has 64bit resolution.
recvBytes64	Received Bytes64	uint64	Number of bytes received by a host. This has 64bit resolution.
pollIntv	Polling Interval	uint32

EventType: PH_DEV_MON_WATCHGUARD_POLICY_STAT

Description: Watchguard Firebox Policy Statistics

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostName	Host Name	string	This is the hostname of the device of interest in the event
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
policyName	Policy Name	string
recvDecryptFail	Recv Decrypt Fail	uint64
authFailure	Auth Failures	uint32
failureCount	Failure Count	uint32
activeSessions	Active Sessions	uint64
totalNum	Total Number of Items	uint32
totBytesPerSec	Total Byte Rate	double
totPktsPerSec	Total Packet Rate	double
pollIntv	Polling Interval	uint32

EventType: PH_DEV_MON_WEBLOGIC_APP

Description: Weblogic app server configuration and metrics

Severity: 1 (Low)

Event Category: 3 (System Logs)

EventType: PH_DEV_MON_WEBLOGIC_DB_POOL

Description: Weblogic database pool metrics

Severity: 1 (Low)

Event Category: 3 (System Logs)

EventType: PH_DEV_MON_WEBLOGIC_EJB

Description: Weblogic EJB metrics

Severity: 1 (Low)

Event Category: 3 (System Logs)

EventType: PH_DEV_MON_WEBLOGIC_GEN

Description: Weblogic generic settings

Severity: 1 (Low)

Event Category: 3 (System Logs)

EventType: PH_DEV_MON_WEBLOGIC_MEMORY

Description: Weblogic memory usage metrics

Severity: 1 (Low)

Event Category: 3 (System Logs)

EventType: PH_DEV_MON_WEBLOGIC_SERVLET

Description: Weblogic servlet metrics

Severity: 1 (Low)

Event Category: 3 (System Logs)

EventType: PH_DEV_MON_WEBLOGIC_SESSION

Description: Weblogic session metrics

Severity: 1 (Low)

Event Category: 3 (System Logs)

EventType: PH_DEV_MON_WEBLOGIC_THREAD_POOL

Description: Weblogic thread pool usage metrics

Severity: 1 (Low)

Event Category: 3 (System Logs)

EventType: PH_DEV_MON_WEBSPHERE_APP

Description: Websphere app server configuration and metrics

Severity: 1 (Low)

Event Category: 3 (System Logs)

EventType: PH_DEV_MON_WEBSPHERE_AUTHENTICATION

Description: Websphere app server authentication metrics

Severity: 1 (Low)

Event Category: 3 (System Logs)

EventType: PH_DEV_MON_WEBSPHERE_CPU

Description: Websphere CPU usage metrics

Severity: 1 (Low)

Event Category: 3 (System Logs)

EventType: PH_DEV_MON_WEBSPHERE_DB_POOL

Description: Websphere database pool metrics

Severity: 1 (Low)

Event Category: 3 (System Logs)

EventType: PH_DEV_MON_WEBSPHERE_EJB

Description: Websphere EJB metrics

Severity: 1 (Low)

Event Category: 3 (System Logs)

EventType: PH_DEV_MON_WEBSPHERE_MEMORY

Description: Websphere memory usage metrics

Severity: 1 (Low)

Event Category: 3 (System Logs)

EventType: PH_DEV_MON_WEBSPHERE_SERVLET

Description: Websphere servlet metrics

Severity: 1 (Low)

Event Category: 3 (System Logs)

EventType: PH_DEV_MON_WEBSPHERE_THREAD_POOL

Description: Websphere thread pool usage metrics

Severity: 1 (Low)

Event Category: 3 (System Logs)

EventType: PH_DEV_MON_WEBSPHERE_TRANSACTION

Description: Websphere app server transaction metrics

Severity: 1 (Low)

Event Category: 3 (System Logs)

EventType: PH_DEV_MON_WMI_PING_STAT

Description: WMI Ping Statistics

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostName	Host Name	string	This is the hostname of the device of interest in the event
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
avgDurationMSec	Avg Round Trip Time	uint32	This attribute represents Average Round Trip Time in msec. Typically used in Ping monitoring.
minDurationMSec	Min Round Trip Time	uint32	This attribute represents Minimum Round Trip Time in msec. Typically used in Ping mo itoring.
maxDurationMSec	Max Round Trip Time	uint32	This attribute represents Maximum Round Trip Time in msec. Typically used in Ping monitoring.
pktLossPct	Packet Loss Pct	double	Ratio of lost packets to the total number of sent packets. Mostly set by ping monitoring.
sysDownTime	System Downtime	uint32
sysDegradedTime	System Degraded Time	uint32
pollIntv	Polling Interval	uint32

EventType: PH_DISCOVERY_COMPLETE

Description: Discovery completed

Severity: 1 (Low)

Event Category: 3 (System Logs)

EventType: PH_DISCOVERY_RESULT_SENT

Description: Discovery results sent to app server

Severity: 1 (Low)

Event Category: 3 (System Logs)

EventType: PH_DISCOV_ACCESS_IP_PARSE_ERROR

Description: Discovery module failed to parse device Access IP from App Server

Severity: 7 (Medium)

Event Category: 3 (System Logs)

EventType: PH_DISCOV_ADS_ACCOUNT_TO_EXPIRE

Description: Active Directory account to excpire in 2 weeks

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
user	User	string
userFullName	User Full Name	string
userDN	User Distinguishing Name	string
daysToAccountExpiry	Days To Account Expiry	uint32

EventType: PH_DISCOV_ADS_ACCT_DISABLED

Description: Accounts Disabled

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
user	User	string
userFullName	User Full Name	string
userDN	User Distinguishing Name	string

EventType: PH_DISCOV_ADS_DORMANT_ACCT

Description: Dormant User Acounts - not log on in last 30 days

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
user	User	string
userFullName	User Full Name	string
userDN	User Distinguishing Name	string
lastLogon	Last Logon Time	Date
daysSinceLastLogon	Days Since Last Logon	uint32

EventType: PH_DISCOV_ADS_PASSWORD_NEVER_EXPIRES

Description: Active Directory user password never expires

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
user	User	string
userFullName	User Full Name	string
userDN	User Distinguishing Name	string
passwordAge	Password Age	uint32
passwordLastSet	Password Last Set	Date

EventType: PH_DISCOV_ADS_PASSWORD_NOT_REQD

Description: Active Directory user password not required

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
user	User	string
userFullName	User Full Name	string
userDN	User Distinguishing Name	string

EventType: PH_DISCOV_ADS_PASSWORD_STALE

Description: Active Directory user password stale - more than 90 days

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
user	User	string
userFullName	User Full Name	string
userDN	User Distinguishing Name	string
passwordAge	Password Age	uint32
passwordLastSet	Password Last Set	Date

EventType: PH_DISCOV_ADS_PASSWORD_TO_EXPIRE

Description: Active Directory user password to excpire in 2 weeks

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
user	User	string
userFullName	User Full Name	string
userDN	User Distinguishing Name	string
daysToPasswordExpiry	Days To Password Expiry	uint32
passwordLastSet	Password Last Set	Date

EventType: PH_DISCOV_ARUBA_WLAN_HOST_LOCATION

Description: Aruba WLAN AP connected Host Identity and Location

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
hostMACAddr	Host MAC	string	Host Layer 2 MAC Address in the log
user	User	string
domain	Domain	string
nepDevIpAddr	Network Access Device IP	IP
nepDevName	Network Access Device	string
nepDevPort	Network Access Device Port	string
wlanSsid	WLAN SSID	string	WLAN Service Set Identifier (SSID) found in SNMP based WLAN monitoring
wlanChannelId	WLAN Channel Id	uint32	WLAN Channel Id found in SNMP based WLAN monitoring
wlanApAssocUpTime	WLAN AP Association Uptime	uint32	WLAN AP Association Uptime found in SNMP based WLAN monitoring
wlanMaxHostTxmitRate	WLAN Max Host Txmit Rate Mbps	uint32	WLAN Max Host Txmit Rate Mbps found in SNMP based WLAN monitoring
wlanContrIpAddr	WLAN Controller IP	IP	WLAN Controller IP found in SNMP based WLAN monitoring
wlanContrHostName	WLAN Controller Host Name	string	WLAN Controller Host Name found in SNMP based WLAN monitoring
wlanRssi	WLAN RSSI dB	int32	WLAN RSSI dB found in SNMP based WLAN monitoring
wlanProtocol	WLAN Protocol	string	WLAN Protocol found in SNMP based WLAN monitoring

EventType: PH_DISCOV_AWS_DEVICE_DELETED

Description: FortiSIEM AWS Discovery discovered a terminated device - this device will be deleted from CMDB

Severity: 7 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
ec2InstanceId	EC2 Instance Id	string
accountId	Account Id	string
awsRegion	AWS Region	string
status	Status	string

EventType: PH_DISCOV_AWS_DEVICE_UNKNOWN

Description: Discovery module failed to recognize AWS device type

Severity: 5 (Medium)

Event Category: 3 (System Logs)

EventType: PH_DISCOV_AWS_DISCOV_FAILED

Description: Discovery module failed to discover AWS environment

Severity: 7 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
errReason	Reason for Error	string	This is the reason for an error if given.

EventType: PH_DISCOV_AZURE_DISCOV_FAILED

Description: Discovery module failed to discover AZURE environment

Severity: 7 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
errReason	Reason for Error	string	This is the reason for an error if given.

EventType: PH_DISCOV_BASIC_FAILED

Description: Basic discovery completely failed for a device

Severity: 7 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
destIpAddr	Destination IP	IP	Destination IP of a device as identified in the event.
phDiscovFailCode	PH Discovery Failure Code	string

EventType: PH_DISCOV_BASIC_SKIPPED

Description: Device discovery skipped because of device type discovery exclusion policy

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
destIpAddr	Destination IP	IP	Destination IP of a device as identified in the event.
phDiscovFailCode	PH Discovery Failure Code	string

EventType: PH_DISCOV_BASIC_SNMP_DETAIL

Description: Device discovery via SNMP details

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
phDiscovSuccessCode	PH Discovery Success Code	string
destIpAddr	Destination IP	IP	Destination IP of a device as identified in the event.

EventType: PH_DISCOV_BASIC_SNMP_ERROR

Description: Device discovery encountered errors

Severity: 7 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
destIpAddr	Destination IP	IP	Destination IP of a device as identified in the event.
phDiscovFailCode	PH Discovery Failure Code	string

EventType: PH_DISCOV_BASIC_SNMP_FAILED

Description: Basic device discovery via SNMP completely failed

Severity: 7 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
destIpAddr	Destination IP	IP	Destination IP of a device as identified in the event.
phDiscovFailCode	PH Discovery Failure Code	string

EventType: PH_DISCOV_BASIC_SNMP_STARTED

Description: Starting device discovery for a device via SNMP

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
destIpAddr	Destination IP	IP	Destination IP of a device as identified in the event.

EventType: PH_DISCOV_BASIC_SNMP_SUCCESS

Description: Device discovery via SNMP succeeded for a device

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
destName	Destination Host Name	string	Destination device's hostname as identified in the log, can also be enriched using reverse lookup of the destination IP address.
destIpAddr	Destination IP	IP	Destination IP of a device as identified in the event.

EventType: PH_DISCOV_BASIC_SSH_DETAIL

Description: Device discovery via SSH details

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
phDiscovSuccessCode	PH Discovery Success Code	string
destIpAddr	Destination IP	IP	Destination IP of a device as identified in the event.

EventType: PH_DISCOV_BASIC_SSH_ERROR

Description: Basic device discovery via SSH encountered errors

Severity: 7 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
destIpAddr	Destination IP	IP	Destination IP of a device as identified in the event.
phDiscovFailCode	PH Discovery Failure Code	string

EventType: PH_DISCOV_BASIC_SSH_FAILED

Description: Basic device discovery via SSH completely failed

Severity: 7 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
destIpAddr	Destination IP	IP	Destination IP of a device as identified in the event.
phDiscovFailCode	PH Discovery Failure Code	string

EventType: PH_DISCOV_BASIC_SSH_STARTED

Description: Device discovery via SSH started for a device

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
destIpAddr	Destination IP	IP	Destination IP of a device as identified in the event.

EventType: PH_DISCOV_BASIC_SSH_SUCCESS

Description: Device discovery via SSH succeeded for a device

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
destName	Destination Host Name	string	Destination device's hostname as identified in the log, can also be enriched using reverse lookup of the destination IP address.
destIpAddr	Destination IP	IP	Destination IP of a device as identified in the event.

EventType: PH_DISCOV_BASIC_STARTED

Description: Starting device discovery for a device

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
destIpAddr	Destination IP	IP	Destination IP of a device as identified in the event.

EventType: PH_DISCOV_BGP_OSPF_FAILED

Description: Failed to send discovery task request for BGP/OSPF change

Severity: 7 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
errReason	Reason for Error	string	This is the reason for an error if given.

EventType: PH_DISCOV_BROCADE_SERVER_IRON_HW_INFO_WARNING

Description: Failed to discover Brocade server iron hardware status

Severity: 5 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostName	Host Name	string	This is the hostname of the device of interest in the event
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
module	Module Name	string
errReason	Reason for Error	string	This is the reason for an error if given.

EventType: PH_DISCOV_CANCEL_UNKNOWN_REQ

Description: Discovery module received discovery cancel request with unknown request ID

Severity: 5 (Medium)

Event Category: 3 (System Logs)

EventType: PH_DISCOV_CERT_FILE_DOWNLOAD_FAILURE

Description: Discovery module failed to download certificate file

Severity: 7 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
filePath	File Path	string

EventType: PH_DISCOV_CHECKPOINT_TEST_CONN_FAILED

Description: Discovery module failed to test connectivity for a Checkpoint device

Severity: 7 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
errReason	Reason for Error	string	This is the reason for an error if given.

EventType: PH_DISCOV_CISCO_ASA_GET_CONTEXT_FAILED

Description: Discovery module failed to discover Cisco ASA device

Severity: 7 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
virtContext	Virtualization Context	string

EventType: PH_DISCOV_CISCO_ASA_IPSEC_VPN_FAILED

Description: Discovery module failed to discover IPSEC VPN for Cisco ASA via SNMP

Severity: 7 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.

EventType: PH_DISCOV_CISCO_ASA_RAS_VPN_FAILED

Description: Discovery module failed to discover RAS VPN for Cisco ASA via SNMP

Severity: 7 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.

EventType: PH_DISCOV_CISCO_ASA_RUN_CONFIG_FAILED

Description: Discovery module failed to discover running config for Cisco ASA via Login

Severity: 7 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
virtContext	Virtualization Context	string

EventType: PH_DISCOV_CISCO_ASA_SET_CONTEXT_FAILED

Description: Discovery module failed to set context for Cisco ASA

Severity: 7 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
virtContext	Virtualization Context	string

EventType: PH_DISCOV_CISCO_ASA_STARTUP_CONFIG_FAILED

Description: Discovery module failed to discover startup config for Cisco ASA via Login

Severity: 7 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
virtContext	Virtualization Context	string

EventType: PH_DISCOV_CISCO_CALL_MANAGER_WARNING

Description: Discovery module failed to obtain Cisco Call Manager statistics

Severity: 5 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostName	Host Name	string	This is the hostname of the device of interest in the event
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
module	Module Name	string
errReason	Reason for Error	string	This is the reason for an error if given.

EventType: PH_DISCOV_CISCO_CATOS_INTF_FAILED

Description: Discovery module failed to find interface by id and name for Cisco CatOS device

Severity: 7 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostName	Host Name	string	This is the hostname of the device of interest in the event
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
intfName	Host Interface Name	string	Name of a network interface in a host.

EventType: PH_DISCOV_CISCO_CDP_ERROR

Description: Discovery module failed to find local interface in CDP

Severity: 7 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostName	Host Name	string	This is the hostname of the device of interest in the event
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.

EventType: PH_DISCOV_CISCO_IOS_L2_WARNING

Description: Discovery module failed to discover Layer 2 for Cisco IOS device - no directly connected host entries

Severity: 5 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostName	Host Name	string	This is the hostname of the device of interest in the event
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.

EventType: PH_DISCOV_CISCO_IOS_TRUNK_PORT_ERROR

Description: Discovery module encountered SNMP index lookup error

Severity: 7 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostName	Host Name	string	This is the hostname of the device of interest in the event
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.

EventType: PH_DISCOV_CISCO_JUNOS_L2_WARNING

Description: Discovery module failed to discover Layer 2 for JUNOS device - no directly connected host entries

Severity: 5 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostName	Host Name	string	This is the hostname of the device of interest in the event
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.

EventType: PH_DISCOV_CISCO_NXOS_HW_STATUS_WARNING

Description: Discovery module failed to obtain Cisco NxOS hardware status

Severity: 5 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostName	Host Name	string	This is the hostname of the device of interest in the event
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
module	Module Name	string
errReason	Reason for Error	string	This is the reason for an error if given.

EventType: PH_DISCOV_CISCO_NXOS_INTF_SHORT_NAME_NOT_FOUND

Description: Discovery module failed to find interface short name for Cisco NxOS

Severity: 5 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostName	Host Name	string	This is the hostname of the device of interest in the event
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.

EventType: PH_DISCOV_CISCO_NXOS_L2_WARNING

Description: Discovery module failed to discover Layer 2 for Cisco NxOS device - no directly connected host entries

Severity: 5 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostName	Host Name	string	This is the hostname of the device of interest in the event
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.

EventType: PH_DISCOV_CISCO_WLAN_HOST_LOCATION

Description: Cisco WLAN AP connected Host Identity and Location

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
hostMACAddr	Host MAC	string	Host Layer 2 MAC Address in the log
user	User	string
domain	Domain	string
nepDevIpAddr	Network Access Device IP	IP
nepDevName	Network Access Device	string
nepDevPort	Network Access Device Port	string
wlanSsid	WLAN SSID	string	WLAN Service Set Identifier (SSID) found in SNMP based WLAN monitoring
wlanContrIpAddr	WLAN Controller IP	IP	WLAN Controller IP found in SNMP based WLAN monitoring
wlanContrHostName	WLAN Controller Host Name	string	WLAN Controller Host Name found in SNMP based WLAN monitoring
wlanRssi	WLAN RSSI dB	int32	WLAN RSSI dB found in SNMP based WLAN monitoring
wlanSnr	WLAN SNR dB	uint32	WLAN SNR dB found in SNMP based WLAN monitoring
wlanProtocol	WLAN Protocol	string	WLAN Protocol found in SNMP based WLAN monitoring

EventType: PH_DISCOV_CLOCK_ROLLS_BACK

Description: FortiSIEM Discovery module discovers excessive clock skew dusing BGP/OSPF discovery

Severity: 7 (Medium)

Event Category: 3 (System Logs)

EventType: PH_DISCOV_CONTACT_APP_SERVER

Description: Discovery module contacting app server

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
destIpAddr	Destination IP	IP	Destination IP of a device as identified in the event.
destIpPort	Destination TCP/UDP Port	uint16	This is the destination TCP or UDP port as identified in the event

EventType: PH_DISCOV_CREDEN_INSERT_ERROR

Description: Discovery module failed to insert device credential into its memory - discovery may fail

Severity: 7 (Medium)

Event Category: 3 (System Logs)

EventType: PH_DISCOV_CUSTOM_MAP_LOAD_FAILED

Description: Discovery module failed to load customer map from App Server

Severity: 7 (Medium)

Event Category: 3 (System Logs)

EventType: PH_DISCOV_DATA_DOMAIN_HW_STATUS_WARNING

Description: Discovery module failed to obtain hardware status from Data Domain device

Severity: 5 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostName	Host Name	string	This is the hostname of the device of interest in the event
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
module	Module Name	string
errReason	Reason for Error	string	This is the reason for an error if given.

EventType: PH_DISCOV_DELL_BLADE_CHASSIS_WARNING

Description: Discovery module failed to discover Dell Blade Chassis

Severity: 5 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostName	Host Name	string	This is the hostname of the device of interest in the event
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
errReason	Reason for Error	string	This is the reason for an error if given.

EventType: PH_DISCOV_DELL_COMPELLENT_STORAGE_WARNING

Description: Discovery module failed to discover volume info for Dell Compellent Storage device

Severity: 5 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostName	Host Name	string	This is the hostname of the device of interest in the event
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
errReason	Reason for Error	string	This is the reason for an error if given.

EventType: PH_DISCOV_DISCOV_REQ_GET_FAILED

Description: Discovery module failed to get discovery request from App server

Severity: 7 (Medium)

Event Category: 3 (System Logs)

EventType: PH_DISCOV_DISCOV_RESULT_SENDER_THREADS_SPAWN_FAILED

Description: Discovery module failed to spawn discovery result sender threads

Severity: 7 (Medium)

Event Category: 3 (System Logs)

EventType: PH_DISCOV_DISCOV_THREADS_SPAWN_FAILED

Description: Discovery module failed to spawn discover threads

Severity: 7 (Medium)

Event Category: 3 (System Logs)

EventType: PH_DISCOV_EC2_INSTANCE_PARSE_FAILED

Description: Discovery module failed to parse EC2 instance xml

Severity: 7 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
errReason	Reason for Error	string	This is the reason for an error if given.

EventType: PH_DISCOV_EMC_CLARION_ERROR

Description: Discovery module failed to discover EMC Clarion

Severity: 7 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.

EventType: PH_DISCOV_EMC_VNX_DISCOV_FAILED

Description: Discovery module failed to discover EMC VNX via navisec client

Severity: 7 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostName	Host Name	string	This is the hostname of the device of interest in the event
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
filePath	File Path	string
errReason	Reason for Error	string	This is the reason for an error if given.

EventType: PH_DISCOV_EMC_VNX_PING_FAILED

Description: Discovery module failed to ping EMC VNX

Severity: 7 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostName	Host Name	string	This is the hostname of the device of interest in the event
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
filePath	File Path	string

EventType: PH_DISCOV_EQLOGIC_CONN_FAILED

Description: Discovery module failed to obtain EqualLogic connection info

Severity: 7 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostName	Host Name	string	This is the hostname of the device of interest in the event
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
module	Module Name	string
oid	Object Identifier	string
errReason	Reason for Error	string	This is the reason for an error if given.

EventType: PH_DISCOV_EQLOGIC_HW_INFO_FAILED

Description: Discovery module failed to obtain EqualLogic metric

Severity: 7 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostName	Host Name	string	This is the hostname of the device of interest in the event
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
module	Module Name	string
oid	Object Identifier	string
errReason	Reason for Error	string	This is the reason for an error if given.

EventType: PH_DISCOV_ESX_HOST_PING_ONLY_DISCOV_ERROR

Description: Ping only discovery for ESX host/vCenter failed

Severity: 7 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
errReason	Reason for Error	string	This is the reason for an error if given.

EventType: PH_DISCOV_FAILED_INVALID_REQUEST

Description: Discovery failed - invalid discovery request from App Server

Severity: 7 (Medium)

Event Category: 3 (System Logs)

EventType: PH_DISCOV_FAILED_INVALID_REQUEST_XML

Description: FortiSIEM discovery module received invalid XML from App Server - discovery will fail

Severity: 7 (Medium)

Event Category: 3 (System Logs)

EventType: PH_DISCOV_FAILED_XML_ERROR

Description: Discovery XML request parse error

Severity: 7 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
phDiscovFailCode	PH Discovery Failure Code	string

EventType: PH_DISCOV_FAIL_CMDB_DEV

Description: Existing CMDB device (re)discovery failed

Severity: 5 (Medium)

Event Category: 3 (System Logs)

EventType: PH_DISCOV_FILE_BASED_DISCOV_DIR_NOT_CONFIGURED

Description: File based discovery failed - discover_file_dir missing in phoenix_config.txt

Severity: 7 (Medium)

Event Category: 3 (System Logs)

EventType: PH_DISCOV_FILE_BASED_DISCOV_FAILED

Description: File based discovery failed - cannot open discovery file

Severity: 7 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
filePath	File Path	string

EventType: PH_DISCOV_FORTINET_CPU_INFO_WARNING

Description: Discovery module failed to discover cpu info for Fortinet appliance

Severity: 5 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostName	Host Name	string	This is the hostname of the device of interest in the event
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
errReason	Reason for Error	string	This is the reason for an error if given.

EventType: PH_DISCOV_FORTINET_LINK_STAT_WARNING

Description: Discovery module failed to discover link stat for Fortinet appliance

Severity: 5 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostName	Host Name	string	This is the hostname of the device of interest in the event
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
errReason	Reason for Error	string	This is the reason for an error if given.

EventType: PH_DISCOV_FORTINET_SYS_UPDATE_VERSION_WARNING

Description: Discovery module failed to discover system auto update versions for Fortinet appliance

Severity: 5 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostName	Host Name	string	This is the hostname of the device of interest in the event
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
errReason	Reason for Error	string	This is the reason for an error if given.

EventType: PH_DISCOV_GENERIC_ERROR

Description: Device discovery encountered generic errors

Severity: 7 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
destIpAddr	Destination IP	IP	Destination IP of a device as identified in the event.
phDiscovFailCode	PH Discovery Failure Code	string

EventType: PH_DISCOV_GEN_WLAN_HOST_LOCATION

Description: Generic WLAN AP connected Host Identity and Location

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
hostMACAddr	Host MAC	string	Host Layer 2 MAC Address in the log
user	User	string
domain	Domain	string
nepDevIpAddr	Network Access Device IP	IP
nepDevName	Network Access Device	string
nepDevPort	Network Access Device Port	string
wlanSsid	WLAN SSID	string	WLAN Service Set Identifier (SSID) found in SNMP based WLAN monitoring
wlanContrIpAddr	WLAN Controller IP	IP	WLAN Controller IP found in SNMP based WLAN monitoring
wlanContrHostName	WLAN Controller Host Name	string	WLAN Controller Host Name found in SNMP based WLAN monitoring

EventType: PH_DISCOV_GET_SNMP_ENGINE_ID_FAILED

Description: Failed to get snmp engine ID

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
destIpAddr	Destination IP	IP	Destination IP of a device as identified in the event.

EventType: PH_DISCOV_HOST_CONVERT_PROCESS_UPTIME_ERROR

Description: Discovery module failed to convert process uptime

Severity: 5 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostName	Host Name	string	This is the hostname of the device of interest in the event
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.

EventType: PH_DISCOV_HOST_ERROR

Description: Discovery module failed to discover device

Severity: 7 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
destIpAddr	Destination IP	IP	Destination IP of a device as identified in the event.
phDiscovFailCode	PH Discovery Failure Code	string

EventType: PH_DISCOV_HOST_INSTALL_SW_WARNING

Description: Discovery module failed to discover installed software

Severity: 5 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostName	Host Name	string	This is the hostname of the device of interest in the event
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
errReason	Reason for Error	string	This is the reason for an error if given.

EventType: PH_DISCOV_HOST_LOCATE_PROCESS_ERROR

Description: Discovery module failed to locate running process by SNMP id

Severity: 5 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostName	Host Name	string	This is the hostname of the device of interest in the event
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.

EventType: PH_DISCOV_HOST_LOCATION

Description: Wired Host IP location message

Severity: 1 (Low)

Event Category: 3 (System Logs)

EventType: PH_DISCOV_HOST_NET_INTF

Description: Host network interface identity message

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
hostMACAddr	Host MAC	string	Host Layer 2 MAC Address in the log
computer	Computer	string

EventType: PH_DISCOV_HOST_STARTED

Description: Host discovery started for a device

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
destName	Destination Host Name	string	Destination device's hostname as identified in the log, can also be enriched using reverse lookup of the destination IP address.
destIpAddr	Destination IP	IP	Destination IP of a device as identified in the event.

EventType: PH_DISCOV_HOST_SUCCESS

Description: Host discovery succeeded for a device

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
destName	Destination Host Name	string	Destination device's hostname as identified in the log, can also be enriched using reverse lookup of the destination IP address.
destIpAddr	Destination IP	IP	Destination IP of a device as identified in the event.

EventType: PH_DISCOV_HOST_SUCCESS_DETAIL

Description: Host discovery success details

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
phDiscovSuccessCode	PH Discovery Success Code	string
destIpAddr	Destination IP	IP	Destination IP of a device as identified in the event.

EventType: PH_DISCOV_HOST_WARNING

Description: Discovery module failed to discover device

Severity: 5 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostName	Host Name	string	This is the hostname of the device of interest in the event
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
module	Module Name	string

EventType: PH_DISCOV_HP3COM_HW_WARNING

Description: Discovery module failed to discover hardware info for HP3Com

Severity: 5 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostName	Host Name	string	This is the hostname of the device of interest in the event
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
errReason	Reason for Error	string	This is the reason for an error if given.

EventType: PH_DISCOV_HP_BLADE_HW_STATUS_WARNING

Description: Discovery module failed to obtain hardware status from HP Blade device

Severity: 5 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostName	Host Name	string	This is the hostname of the device of interest in the event
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
module	Module Name	string
errReason	Reason for Error	string	This is the reason for an error if given.

EventType: PH_DISCOV_INIT_MODULE_FAILED

Description: Discovery module failed to initialize

Severity: 10 (High)

Event Category: 3 (System Logs)

EventType: PH_DISCOV_INTERFACE_VIA_SNMP_FAILED

Description: Discovery module failed to discover network interfaces vis SNMP

Severity: 5 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostName	Host Name	string	This is the hostname of the device of interest in the event
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
errReason	Reason for Error	string	This is the reason for an error if given.

EventType: PH_DISCOV_IP_TYPE_INVALID

Description: Invalid IP type

Severity: 7 (Medium)

Event Category: 3 (System Logs)

EventType: PH_DISCOV_ISILON_HW_STATUS_WARNING

Description: Discovery module failed to obtain hardware status from Isilon device

Severity: 5 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostName	Host Name	string	This is the hostname of the device of interest in the event
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
module	Module Name	string
errReason	Reason for Error	string	This is the reason for an error if given.

EventType: PH_DISCOV_JMX_TEST_CONN_FAILED

Description: Discovery module failed to test conn for JMX server

Severity: 7 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
errReason	Reason for Error	string	This is the reason for an error if given.

EventType: PH_DISCOV_JUNIPER_SSG_HW_INFO_WARNING

Description: Juniper SSG hardware warning

Severity: 3 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostName	Host Name	string	This is the hostname of the device of interest in the event
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
module	Module Name	string
errReason	Reason for Error	string	This is the reason for an error if given.

EventType: PH_DISCOV_L2_FAILED

Description: Layer 2 device discovery completely failed

Severity: 7 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
destName	Destination Host Name	string	Destination device's hostname as identified in the log, can also be enriched using reverse lookup of the destination IP address.
destIpAddr	Destination IP	IP	Destination IP of a device as identified in the event.
phDiscovFailCode	PH Discovery Failure Code	string

EventType: PH_DISCOV_L2_STARTED

Description: Layer 2 device discovery started for a device

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
destName	Destination Host Name	string	Destination device's hostname as identified in the log, can also be enriched using reverse lookup of the destination IP address.

EventType: PH_DISCOV_L2_SUCCESS

Description: Layer 2 device discovery succeeded for a device

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
destName	Destination Host Name	string	Destination device's hostname as identified in the log, can also be enriched using reverse lookup of the destination IP address.
destIpAddr	Destination IP	IP	Destination IP of a device as identified in the event.

EventType: PH_DISCOV_LDAP_ERROR

Description: LDAP discovery failed

Severity: 7 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
destIpAddr	Destination IP	IP	Destination IP of a device as identified in the event.
phDiscovFailCode	PH Discovery Failure Code	string

EventType: PH_DISCOV_LDAP_OU_ERROR

Description: Discovery module failed to lookup LDAP OU in its memory

Severity: 7 (Medium)

Event Category: 3 (System Logs)

EventType: PH_DISCOV_LINUX_DSKTABLE_NOT_CONFIG

Description: Linux disk discovery imcomplete - Dsktable MIB not configured on Linux server

Severity: 5 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostName	Host Name	string	This is the hostname of the device of interest in the event
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
diskName	Disk Name	string

EventType: PH_DISCOV_LOGIN_ERROR

Description: Discovery / Perf monitoring module failed to execute command via SSH/TELNET

Severity: 7 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
destIpAddr	Destination IP	IP	Destination IP of a device as identified in the event.
phDiscovFailCode	PH Discovery Failure Code	string
script	Script	string
command	Command	string

EventType: PH_DISCOV_NEXT_HOP_VIA_SNMP_FAILED

Description: Discovery module failed to discover next hop address vis SNMP

Severity: 5 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostName	Host Name	string	This is the hostname of the device of interest in the event
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.

EventType: PH_DISCOV_NIMBLE_VOLUME_WARNING

Description: Failed to discover volume for Nimble storage

Severity: 5 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostName	Host Name	string	This is the hostname of the device of interest in the event
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
errReason	Reason for Error	string	This is the reason for an error if given.

EventType: PH_DISCOV_NOZOMI_DISCOV_FAILED

Description: Discovery module failed to discover Nozomi environment

Severity: 7 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
errReason	Reason for Error	string	This is the reason for an error if given.

EventType: PH_DISCOV_PARAM_PARSE_FAILED

Description: Discovery module failed to parse parameters in discovery XML from App server

Severity: 7 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
errReason	Reason for Error	string	This is the reason for an error if given.

EventType: PH_DISCOV_PARSER_MSG_EXCEEDS_THRESHOLD

Description: Number of parser-to-discover messages to be processed exceeds threshold, discard the oldest one

Severity: 5 (Medium)

Event Category: 3 (System Logs)

EventType: PH_DISCOV_PARSER_MSG_THREAD_SPAWN_FAILED

Description: Discovery module failed to spawn processParserMessage thread

Severity: 7 (Medium)

Event Category: 3 (System Logs)

EventType: PH_DISCOV_PERF_TEMPLATE_LOAD_FAILED

Description: Discovery module failed to load performance template from App Server

Severity: 7 (Medium)

Event Category: 3 (System Logs)

EventType: PH_DISCOV_PING_ONLY_LIST_NOT_MATCH

Description: Discovery module found that ping-only-discover device list does not match include-ip device list. Ping-only-discovery is not effective

Severity: 5 (Medium)

Event Category: 3 (System Logs)

EventType: PH_DISCOV_READ_COMPRESS_THRESHOLD_FAILED

Description: Discovery module failed to read discover_compress_threshold from phoenix configuration, will set it to 2048 bytes

Severity: 5 (Medium)

Event Category: 3 (System Logs)

EventType: PH_DISCOV_RECVD_VALID_REQUEST

Description: Received valid discovery request from app server

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
destIpAddr	Destination IP	IP	Destination IP of a device as identified in the event.

EventType: PH_DISCOV_RESULT_SEND_FAILED

Description: Discovery module failed to send discovery result to App server after many retries; discovery will fail

Severity: 8 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
phDiscovFailCode	PH Discovery Failure Code	string

EventType: PH_DISCOV_RESULT_SEND_WARNING

Description: Discovery module failed to upload discovery result to App Server, will retry

Severity: 5 (Medium)

Event Category: 3 (System Logs)

EventType: PH_DISCOV_RESULT_XML_WRITE_FAILURE

Description: Discovery module failed to create discovery result XML file

Severity: 7 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostName	Host Name	string	This is the hostname of the device of interest in the event
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.

EventType: PH_DISCOV_RUNNING_SERVICE

Description: Found running service on host

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
hostName	Host Name	string	This is the hostname of the device of interest in the event
ipProto	IP Protocol	uint16	IP Protocol, e.g. TCP, UDP, ICMP etc as defined in IP RFPs
destIpPort	Destination TCP/UDP Port	uint16	This is the destination TCP or UDP port as identified in the event
appName	Application Name	string

EventType: PH_DISCOV_RUN_JAVA_PROBE_ERROR

Description: Discovery module failed to execute runJavaProbe.sh

Severity: 5 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
exitValue	Command exit value	int32

EventType: PH_DISCOV_RUN_SW_FILTER_LOAD_FAILED

Description: Discovery module failed to load Running Software Filter from App Server - running software filter may not be discovered correctly

Severity: 7 (Medium)

Event Category: 3 (System Logs)

EventType: PH_DISCOV_RUN_SW_FILTER_PARSE_FAILED

Description: Discovery module failed to parse running software filter xml from App Server - running software filter may not be discovered correctly

Severity: 7 (Medium)

Event Category: 3 (System Logs)

EventType: PH_DISCOV_RUN_VM_TEST_CONN_ERROR

Description: Discovery module failed to execute VMWare Test Connectivity (runVmTestConn.sh)

Severity: 5 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
exitValue	Command exit value	int32

EventType: PH_DISCOV_SKIPPED

Description: Skipping device discovery by discovery request policy

Severity: 1 (Low)

Event Category: 3 (System Logs)

EventType: PH_DISCOV_SKIP_DEV

Description: Discovery skipped a device for discovery

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
msg	Message	string

EventType: PH_DISCOV_SNMP_ERROR

Description: Discovery module failed to get data via SNMP

Severity: 7 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
destIpAddr	Destination IP	IP	Destination IP of a device as identified in the event.
phDiscovFailCode	PH Discovery Failure Code	string

EventType: PH_DISCOV_SSH_ERROR

Description: Discovery module failed to execute command via SSH

Severity: 7 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
destIpAddr	Destination IP	IP	Destination IP of a device as identified in the event.
phDiscovFailCode	PH Discovery Failure Code	string
script	Script	string
command	Command	string

EventType: PH_DISCOV_START

Description: Discovery module starting

Severity: 1 (Low)

Event Category: 3 (System Logs)

EventType: PH_DISCOV_TELNET_ERROR

Description: Discovery module failed to execute command via TELNET

Severity: 7 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
destIpAddr	Destination IP	IP	Destination IP of a device as identified in the event.
phDiscovFailCode	PH Discovery Failure Code	string
script	Script	string
command	Command	string

EventType: PH_DISCOV_TEST_CONN_GET_REQ_FAILED

Description: Discovery module failed to get test connectivity request from App server

Severity: 9 (High)

Event Category: 3 (System Logs)

EventType: PH_DISCOV_TEST_CONN_MSRPC_ERROR

Description: Discovery module failed to test connection to a Windows Server via MSRPC

Severity: 7 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
filePath	File Path	string
errReason	Reason for Error	string	This is the reason for an error if given.

EventType: PH_DISCOV_TEST_CONN_NO_UCSAPI_CRED

Description: Discovery module failed to test connection to a Cisco UCS Server via UCS API

Severity: 7 (Medium)

Event Category: 3 (System Logs)

EventType: PH_DISCOV_TEST_CONN_RESULT_SENDER_THREADS_SPAWN_FAILED

Description: Discovery module failed to spawn test connectivity result sender threads

Severity: 7 (Medium)

Event Category: 3 (System Logs)

EventType: PH_DISCOV_TEST_CONN_RESULT_SEND_ERROR

Description: Discovery module encountered error in sending Test Connectivity result to app server

Severity: 9 (High)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
phDiscovFailCode	PH Discovery Failure Code	string

EventType: PH_DISCOV_TEST_CONN_RESULT_SEND_WARNING

Description: Discovery module failed to upload test connectivity result to App Server

Severity: 9 (High)

Event Category: 3 (System Logs)

EventType: PH_DISCOV_TEST_CONN_THREADS_SPAWN_FAILED

Description: Discovery module failed to spawn test connectivity threads

Severity: 7 (Medium)

Event Category: 3 (System Logs)

EventType: PH_DISCOV_TEST_CONN_VMSDK_ERROR

Description: Discovery module encountered VMSDK test connection error

Severity: 7 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
errReason	Reason for Error	string	This is the reason for an error if given.

EventType: PH_DISCOV_TRIPP_UPS_HW_STATUS_WARNING

Description: Discovery module failed to obtain hardware status from Tripp UPS device

Severity: 5 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostName	Host Name	string	This is the hostname of the device of interest in the event
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
module	Module Name	string
errReason	Reason for Error	string	This is the reason for an error if given.

EventType: PH_DISCOV_TRUNK_PORTS_ERROR

Description: Discovery module failed to get network device trunk port information from App server

Severity: 7 (Medium)

Event Category: 3 (System Logs)

EventType: PH_DISCOV_UNHANDLED_ACCESS_PROTO

Description: Discovery module encountered unhandled device access method

Severity: 4 (Low)

Event Category: 3 (System Logs)

EventType: PH_DISCOV_UPLOAD_DATA_FAILED

Description: Discovery module failed to upload discovery results to App Server

Severity: 9 (High)

Event Category: 3 (System Logs)

EventType: PH_DISCOV_VMWARE_DUP_DEV_ID

Description: Discovery module encoutered VMSDK discovery error because of duplicated device id

Severity: 7 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
filePath	File Path	string

EventType: PH_DISCOV_VMWARE_ERROR

Description: Discovery module failed to discover device via VMSDK

Severity: 7 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
errReason	Reason for Error	string	This is the reason for an error if given.

EventType: PH_DISCOV_VOIP_PHONE_ID

Description: VoIP phone identity message

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
hostIpAddr	Host IP	IP	This is the IP of the device of interest in the event.
computer	Computer	string
hostMACAddr	Host MAC	string	Host Layer 2 MAC Address in the log
user	User	string
domain	Domain	string
voIPPhoneStatus	VoIP Phone Status	string

EventType: PH_DISCOV_WMI_PULL_ERROR

Description: Windows WMI pulling error

Severity: 7 (Medium)

Event Category: 3 (System Logs)

EventType: PH_DISC_DATA_PROCESS_ERROR

Description: Discovery result process error

Severity: 5 (Medium)

Event Category: 3 (System Logs)

EventType: PH_DIVIDE_BY_ZERO

Description: Devide by zero

Severity: 6 (Medium)

Event Category: 3 (System Logs)

EventType: PH_DROP_EVENT_FROM_SHARED_BUFFER

Description: Event dropped from shared buffer

Severity: 5 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
phCustId	Organization ID	uint32	This is the FortiSIEM organization ID unique to each tenant
collectorId	Collector ID	uint32	This field captures the ID of a FortiSIEM Collector
count	Count	uint32	A general count variable. A common use case is for incidents. Count represents how many times an Incident occurred in a time interval. When an Incident with the same group by parameters occurs again. The count is incremented and the Last Seen time is advanced. Count can be used for other events also.

EventType: PH_DROP_INCIDENT

Description: Incident dropped

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
ruleId	Rule ID	uint64	Unique ID of a FortiSIEM rule.
ruleName	Rule Name	string	FortiSIEM rule name.
incidentId	Incident ID	uint64	Unique ID of a FortiSIEM Incident
details	Details	string
errReason	Reason for Error	string	This is the reason for an error if given.

EventType: PH_DROP_INCIDENT_COUNT

Description: Dropped incident count

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
phCustId	Organization ID	uint32	This is the FortiSIEM organization ID unique to each tenant
ruleId	Rule ID	uint64	Unique ID of a FortiSIEM rule.
incidentCount	Triggered Event Count	uint32	This field represents the number of Triggering events in an Incident.
policyName	Policy Name	string

EventType: PH_ES_ARCHIVE_STORAGE_CHECK_ERROR

Description: Failed to get disk usage of Elasticsearch Cluster archive

Severity: 10 (High)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
errReason	Reason for Error	string	This is the reason for an error if given.

EventType: PH_ES_ARCHIVE_STORAGE_LOW

Description: The available storage of archive for Elasticsearch Cluster is low

Severity: 3 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
totalDiskMB	Total Disk MB	uint32
freeDiskMB	Free Disk MB	uint32

EventType: PH_ES_ARCHIVE_STORAGE_PURGING_FAILED

Description: Failed purge snapshot from archive on Elasticsearch Cluster

Severity: 10 (High)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
errReason	Reason for Error	string	This is the reason for an error if given.

EventType: PH_ES_ARCHIVE_STORAGE_PURGING_FINISHED

Description: Finished purge snapshot from archive on Elasticsearch Cluster

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
totBytes64	Total Bytes64	uint64	Total number of sent and received bytes by a host. This has 64bit resolution.

EventType: PH_ES_ARCHIVE_STORAGE_PURGING_STARTED

Description: Start purge snapshots from archive on Elasticsearch Cluster

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
totBytes64	Total Bytes64	uint64	Total number of sent and received bytes by a host. This has 64bit resolution.

EventType: PH_ES_ARCHIVE_STORAGE_PURGING_SUCCESS

Description: Succeed purge snapshots from archive on Elasticsearch Cluster

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
totBytes64	Total Bytes64	uint64	Total number of sent and received bytes by a host. This has 64bit resolution.

EventType: PH_ES_ARCHIVE_STORAGE_USAGE

Description: Disk usage of Elasticsearch Cluster archive

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
totalDiskMB	Total Disk MB	uint32
freeDiskMB	Free Disk MB	uint32

EventType: PH_ES_CCR_DELAY

Description: Elasticsearch CCR delay detail

Severity: 5 (Medium)

Event Category: 3 (System Logs)

EventType: PH_ES_COLD_STORAGE_ARCHIVING_FAILED

Description: Failed to archive indices from cold nodes on Elasticsearch Cluster

Severity: 10 (High)

Event Category: 3 (System Logs)

EventType: PH_ES_COLD_STORAGE_ARCHIVING_FINISHED

Description: Finished archive indices from cold nodes on Elasticsearch Cluster

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
totBytes64	Total Bytes64	uint64	Total number of sent and received bytes by a host. This has 64bit resolution.

EventType: PH_ES_COLD_STORAGE_ARCHIVING_STARTED

Description: Start archive indices from cold nodes on Elasticsearch Cluster

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
totBytes64	Total Bytes64	uint64	Total number of sent and received bytes by a host. This has 64bit resolution.

EventType: PH_ES_COLD_STORAGE_ARCHIVING_SUCCESS

Description: Successfully archived indices from cold nodes on Elasticsearch Cluster

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
totBytes64	Total Bytes64	uint64	Total number of sent and received bytes by a host. This has 64bit resolution.

EventType: PH_ES_COLD_STORAGE_CHECK_ERROR

Description: Failed to get disk usage of Elasticsearch Cluster cold nodes

Severity: 10 (High)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
errReason	Reason for Error	string	This is the reason for an error if given.

EventType: PH_ES_COLD_STORAGE_LOW

Description: The available storage of cold nodes on Elasticsearch Cluster is low

Severity: 3 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
totalDiskMB	Total Disk MB	uint32
freeDiskMB	Free Disk MB	uint32

EventType: PH_ES_COLD_STORAGE_PURGING_FAILED

Description: Failed purge indices from cold nodes on Elasticsearch Cluster

Severity: 10 (High)

Event Category: 3 (System Logs)

EventType: PH_ES_COLD_STORAGE_PURGING_FINISHED

Description: Finished purge indices from cold nodes on Elasticsearch Cluster

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
totBytes64	Total Bytes64	uint64	Total number of sent and received bytes by a host. This has 64bit resolution.

EventType: PH_ES_COLD_STORAGE_PURGING_STARTED

Description: Start purge indices from cold nodes on Elasticsearch Cluster

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
totBytes64	Total Bytes64	uint64	Total number of sent and received bytes by a host. This has 64bit resolution.

EventType: PH_ES_COLD_STORAGE_PURGING_SUCCESS

Description: Succeed purge indices from cold nodes on Elasticsearch Cluster

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
totBytes64	Total Bytes64	uint64	Total number of sent and received bytes by a host. This has 64bit resolution.

EventType: PH_ES_COLD_STORAGE_USAGE

Description: Disk usage of Elasticsearch Cold nodes

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
totalDiskMB	Total Disk MB	uint32
freeDiskMB	Free Disk MB	uint32

EventType: PH_ES_HOTCOLD_STORAGE_MOVING_FAILED

Description: Failed move indices from Hot to cold nodes on Elasticsearch Cluster

Severity: 10 (High)

Event Category: 3 (System Logs)

EventType: PH_ES_HOTCOLD_STORAGE_MOVING_FINISHED

Description: Finished moved indices from Hot to cold nodes on Elasticsearch Cluster

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
totBytes64	Total Bytes64	uint64	Total number of sent and received bytes by a host. This has 64bit resolution.

EventType: PH_ES_HOTCOLD_STORAGE_MOVING_STARTED

Description: Start move indices from Hot to cold nodes on Elasticsearch Cluster

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
totBytes64	Total Bytes64	uint64	Total number of sent and received bytes by a host. This has 64bit resolution.

EventType: PH_ES_HOTCOLD_STORAGE_MOVING_SUCCESS

Description: Succeed moved indices from Hot to cold nodes on Elasticsearch Cluster

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
totBytes64	Total Bytes64	uint64	Total number of sent and received bytes by a host. This has 64bit resolution.

EventType: PH_ES_HOT_STORAGE_ARCHIVING_FAILED

Description: Failed archive indices from hot nodes on Elasticsearch Cluster

Severity: 10 (High)

Event Category: 3 (System Logs)

EventType: PH_ES_HOT_STORAGE_ARCHIVING_FINISHED

Description: Finished archive indices from hot nodes on Elasticsearch Cluster

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
totBytes64	Total Bytes64	uint64	Total number of sent and received bytes by a host. This has 64bit resolution.

EventType: PH_ES_HOT_STORAGE_ARCHIVING_STARTED

Description: Start archive indices from hot nodes on Elasticsearch Cluster

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
totBytes64	Total Bytes64	uint64	Total number of sent and received bytes by a host. This has 64bit resolution.

EventType: PH_ES_HOT_STORAGE_ARCHIVING_SUCCESS

Description: Succeed archive indices from hot nodes on Elasticsearch Cluster

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
totBytes64	Total Bytes64	uint64	Total number of sent and received bytes by a host. This has 64bit resolution.

EventType: PH_ES_HOT_STORAGE_CHECK_ERROR

Description: Failed to get disk usage of Elasticsearch Cluster Hot Nodes

Severity: 10 (High)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
errReason	Reason for Error	string	This is the reason for an error if given.

EventType: PH_ES_HOT_STORAGE_LOW

Description: The available storage of Hot Nodes on Elasticsearch Cluster is low

Severity: 3 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
totalDiskMB	Total Disk MB	uint32
freeDiskMB	Free Disk MB	uint32

EventType: PH_ES_HOT_STORAGE_MOVING_FAILED

Description: Failed move indices from Hot to warm nodes on Elasticsearch Cluster

Severity: 10 (High)

Event Category: 3 (System Logs)

EventType: PH_ES_HOT_STORAGE_MOVING_FINISHED

Description: Finished moved indices from Hot to warm nodes on Elasticsearch Cluster

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
totBytes64	Total Bytes64	uint64	Total number of sent and received bytes by a host. This has 64bit resolution.

EventType: PH_ES_HOT_STORAGE_MOVING_STARTED

Description: Start move indices from Hot to warm nodes on Elasticsearch Cluster

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
totBytes64	Total Bytes64	uint64	Total number of sent and received bytes by a host. This has 64bit resolution.

EventType: PH_ES_HOT_STORAGE_MOVING_SUCCESS

Description: Succeed moved indices from Hot to warm nodes on Elasticsearch Cluster

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
totBytes64	Total Bytes64	uint64	Total number of sent and received bytes by a host. This has 64bit resolution.

EventType: PH_ES_HOT_STORAGE_PURGING_FAILED

Description: Failed purge indices from hot nodes on Elasticsearch Cluster

Severity: 10 (High)

Event Category: 3 (System Logs)

EventType: PH_ES_HOT_STORAGE_PURGING_FINISHED

Description: Finished purge indices from hot nodes on Elasticsearch Cluster

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
totBytes64	Total Bytes64	uint64	Total number of sent and received bytes by a host. This has 64bit resolution.

EventType: PH_ES_HOT_STORAGE_PURGING_STARTED

Description: Start purge indices from hot nodes on Elasticsearch Cluster

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
totBytes64	Total Bytes64	uint64	Total number of sent and received bytes by a host. This has 64bit resolution.

EventType: PH_ES_HOT_STORAGE_PURGING_SUCCESS

Description: Succeed purge indices from hot nodes on Elasticsearch Cluster

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
totBytes64	Total Bytes64	uint64	Total number of sent and received bytes by a host. This has 64bit resolution.

EventType: PH_ES_HOT_STORAGE_USAGE

Description: Disk usage of Elasticsearch Hot Nodes

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
totalDiskMB	Total Disk MB	uint32
freeDiskMB	Free Disk MB	uint32

EventType: PH_ES_INDEX_SEGMENT_MERGE_FAILED

Description: Elasticsearch index segment merge failed

Severity: 7 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
errReason	Reason for Error	string	This is the reason for an error if given.

EventType: PH_ES_REST_FAILED

Description: ES REST returns error

Severity: 7 (Medium)

Event Category: 3 (System Logs)

EventType: PH_ES_SM_ADD_INDEX_FAILED

Description: Failed to add ShardManager Index

Severity: 7 (Medium)

Event Category: 3 (System Logs)

EventType: PH_ES_SM_HOURCHECK_FAILED

Description: Failed ShardManager hourcheck

Severity: 7 (Medium)

Event Category: 3 (System Logs)

EventType: PH_ES_SM_INIT_FAILED

Description: Failed to init ShardManager

Severity: 7 (Medium)

Event Category: 3 (System Logs)

EventType: PH_ES_SM_INIT_INDEX_FAILED

Description: Failed to init ShardManager Index

Severity: 7 (Medium)

Event Category: 3 (System Logs)

EventType: PH_ES_SNAPSHOT_FAILED

Description: Failed to do snapshot for ES

Severity: 7 (Medium)

Event Category: 3 (System Logs)

EventType: PH_ES_TO_NFS_ARCHIVE_FAILED_ADD_INDEX

Description: ES TO NFS Archive failed to add an index

Severity: 7 (Medium)

Event Category: 3 (System Logs)

EventType: PH_ES_WARM_STORAGE_ARCHIVING_FAILED

Description: Failed to archive indices from warm nodes on Elasticsearch Cluster

Severity: 10 (High)

Event Category: 3 (System Logs)

EventType: PH_ES_WARM_STORAGE_ARCHIVING_FINISHED

Description: Finished archive indices from warm nodes on Elasticsearch Cluster

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
totBytes64	Total Bytes64	uint64	Total number of sent and received bytes by a host. This has 64bit resolution.

EventType: PH_ES_WARM_STORAGE_ARCHIVING_STARTED

Description: Start archive indices from warm nodes on Elasticsearch Cluster

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
totBytes64	Total Bytes64	uint64	Total number of sent and received bytes by a host. This has 64bit resolution.

EventType: PH_ES_WARM_STORAGE_ARCHIVING_SUCCESS

Description: Successfully archived indices from warm nodes on Elasticsearch Cluster

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
totBytes64	Total Bytes64	uint64	Total number of sent and received bytes by a host. This has 64bit resolution.

EventType: PH_ES_WARM_STORAGE_CHECK_ERROR

Description: Failed to get disk usage of Elasticsearch Cluster warm nodes

Severity: 10 (High)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
errReason	Reason for Error	string	This is the reason for an error if given.

EventType: PH_ES_WARM_STORAGE_LOW

Description: The available storage of warm nodes on Elasticsearch Cluster is low

Severity: 3 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
totalDiskMB	Total Disk MB	uint32
freeDiskMB	Free Disk MB	uint32

EventType: PH_ES_WARM_STORAGE_MOVING_FAILED

Description: Failed move indices from Warm to cold nodes on Elasticsearch Cluster

Severity: 10 (High)

Event Category: 3 (System Logs)

EventType: PH_ES_WARM_STORAGE_MOVING_FINISHED

Description: Finished moved indices from Warm to cold nodes on Elasticsearch Cluster

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
totBytes64	Total Bytes64	uint64	Total number of sent and received bytes by a host. This has 64bit resolution.

EventType: PH_ES_WARM_STORAGE_MOVING_STARTED

Description: Start move indices from Warm to cold nodes on Elasticsearch Cluster

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
totBytes64	Total Bytes64	uint64	Total number of sent and received bytes by a host. This has 64bit resolution.

EventType: PH_ES_WARM_STORAGE_MOVING_SUCCESS

Description: Succeed moved indices from Warm to cold nodes on Elasticsearch Cluster

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
totBytes64	Total Bytes64	uint64	Total number of sent and received bytes by a host. This has 64bit resolution.

EventType: PH_ES_WARM_STORAGE_PURGING_FAILED

Description: Failed purge indices from warm nodes on Elasticsearch Cluster

Severity: 10 (High)

Event Category: 3 (System Logs)

EventType: PH_ES_WARM_STORAGE_PURGING_FINISHED

Description: Finished purge indices from warm nodes on Elasticsearch Cluster

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
totBytes64	Total Bytes64	uint64	Total number of sent and received bytes by a host. This has 64bit resolution.

EventType: PH_ES_WARM_STORAGE_PURGING_STARTED

Description: Start purge indices from warm nodes on Elasticsearch Cluster

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
totBytes64	Total Bytes64	uint64	Total number of sent and received bytes by a host. This has 64bit resolution.

EventType: PH_ES_WARM_STORAGE_PURGING_SUCCESS

Description: Succeed purge indices from warm nodes on Elasticsearch Cluster

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
totBytes64	Total Bytes64	uint64	Total number of sent and received bytes by a host. This has 64bit resolution.

EventType: PH_ES_WARM_STORAGE_USAGE

Description: Disk usage of Elasticsearch Warm nodes

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
totalDiskMB	Total Disk MB	uint32
freeDiskMB	Free Disk MB	uint32

EventType: PH_EVENT_ATTR_XML_ISSUE

Description: Event attribute xml issue

Severity: 6 (Medium)

Event Category: 3 (System Logs)

EventType: PH_EVENT_FORWARDER_CHECKSUM_MISMATCH

Description: FortiSIEM Event Forwarder module encountered checksum error

Severity: 7 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
filePath	File Path	string

EventType: PH_EVENT_FORWARDER_CONNECT_ERROR

Description: FortiSIEM Event Forwarder failed to connect to forwdarding destination host

Severity: 7 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
errorNoInt	Error Number Int	int32

EventType: PH_EVENT_FORWARDER_DIR_OPEN_FAILURE

Description: FortiSIEM Event Forwarder failed to open directory

Severity: 7 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
dirName	Directory Name	string

EventType: PH_EVENT_FORWARDER_FILE_OPEN_FAILURE

Description: FortiSIEM Event Forwarder failed to open file

Severity: 7 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
filePath	File Path	string

EventType: PH_EVENT_FORWARDER_FILE_RENAME_FAILURE

Description: FortiSIEM Event Forwarder failed to rename file

Severity: 7 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
srcFilePath	Source File Path	string
destFilePath	Destination File Path	string

EventType: PH_EVENT_FORWARDER_INIT_FAILURE

Description: FortiSIEM Event Forwarder module initialization failure

Severity: 10 (High)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
funName	Function Name	string

EventType: PH_EVENT_FORWARDER_INVALID_GZIP_FILE

Description: FortiSIEM Event Forwarder module encountered invalid gzip file

Severity: 7 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
filePath	File Path	string

EventType: PH_EVENT_FORWARDER_INVALID_PHOENIX_CONFIG

Description: FortiSIEM Event Forwarder module encountered invalid phoenix_config file

Severity: 7 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
module	Module Name	string
configName	Config Name	string
configValue	Config Value	string

EventType: PH_EVENT_FORWARDER_INVALID_PROTOCOL

Description: FortiSIEM Event Forwarder module encountered invalid forwarding protocol

Severity: 7 (Medium)

Event Category: 3 (System Logs)

EventType: PH_EVENT_FORWARDER_KAFKA_ERROR

Description: FortiSIEM Event Forwarder module encountered Kafka protocol error

Severity: 7 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
errorString	Error String	string	This is the error message, synonymous to attribute errReason
actionName	Notification Action Name	string

EventType: PH_EVENT_FORWARDER_KAFKA_INIT_FAILURE

Description: FortiSIEM Event Forwarder module initialization failure

Severity: 10 (High)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
errorString	Error String	string	This is the error message, synonymous to attribute errReason

EventType: PH_EVENT_FORWARDER_KAFKA_PRODUCE_ERROR

Description: FortiSIEM Event Forwarder module encountered error while forwarding via Kafka protocol

Severity: 7 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
errorString	Error String	string	This is the error message, synonymous to attribute errReason

EventType: PH_EVENT_FORWARDER_MKDIR_FAILURE

Description: FortiSIEM Event Forwarder failed to create directory

Severity: 7 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
dirName	Directory Name	string

EventType: PH_EVENT_FORWARDER_RUN_PROCESS_ERROR

Description: FortiSIEM Event Forwarder failed to run process during execution

Severity: 7 (Medium)

Event Category: 3 (System Logs)

EventType: PH_EVENT_FORWARDER_SOCKET_ERROR

Description: FortiSIEM Event Forwarder failed to create socket

Severity: 7 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
errorNoInt	Error Number Int	int32

EventType: PH_EVENT_FORWARDER_SOCKET_WRITE_ERROR

Description: FortiSIEM Event Forwarder failed to write to socket

Severity: 7 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
errorNoInt	Error Number Int	int32

EventType: PH_EVENT_FORWARDER_SSL_CERT_ERROR

Description: FortiSIEM Event Forwarder SSL certification error

Severity: 7 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
errReason	Reason for Error	string	This is the reason for an error if given.

EventType: PH_EVENT_FORWARDER_SSL_ERROR

Description: FortiSIEM Event Forwarder Generic SSL error

Severity: 7 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
errReason	Reason for Error	string	This is the reason for an error if given.

EventType: PH_EVENT_FWD_CERT_LOAD_FAILED

Description: Event Forwarder module failed to load certification file or key file for TLS based forwarding - forwarding via this method will not occur

Severity: 7 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
errorString	Error String	string	This is the error message, synonymous to attribute errReason

EventType: PH_EVENT_FWD_CERT_UNPAIRED

Description: Event Forwarder module detected unpaired certififcation file or key file - forwarding via this method will not occur

Severity: 7 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
errorString	Error String	string	This is the error message, synonymous to attribute errReason

EventType: PH_EVENT_FWD_DIR_MAKE_FAILED

Description: Event Forwarder module failed to create a directory during initialization

Severity: 7 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
dirName	Directory Name	string

EventType: PH_EVENT_FWD_DIR_OPEN_FAILED

Description: Event Forwarder module failed to open a directory

Severity: 7 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
dirName	Directory Name	string

EventType: PH_EVENT_FWD_FILE_RENAME_FAILED

Description: Event Forwarder module failed to rename a file

Severity: 3 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
srcFilePath	Source File Path	string
destFilePath	Destination File Path	string

EventType: PH_EVENT_FWD_FULL_FORWARDING_FAILED

Description: Event Forwarder failed to forward all events in one file to the destination, will retry

Severity: 3 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
destIpAddr	Destination IP	IP	Destination IP of a device as identified in the event.
destIpPort	Destination TCP/UDP Port	uint16	This is the destination TCP or UDP port as identified in the event

EventType: PH_EVENT_FWD_GET_FILE_NUM_FAILURE

Description: Event Forwarder module failed to get event file count in /opt/phoenix/cache/parser/fwd

Severity: 5 (Medium)

Event Category: 3 (System Logs)

EventType: PH_EVENT_FWD_GZ_CLOSE_ERROR

Description: Event Forwarder module cannot close gz file stored in /opt/phoenix/cache/parser/fwd - event will not be forwarded

Severity: 7 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
filePath	File Path	string

EventType: PH_EVENT_FWD_GZ_FILE_OPEN_ERROR

Description: Event Forwarder failed to open event file (gz), or not enough memory to open it

Severity: 7 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
filePath	File Path	string

EventType: PH_EVENT_FWD_GZ_MD5_ERROR

Description: Event Forwarder module cannot get md5 of event file (gz)

Severity: 7 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
filePath	File Path	string

EventType: PH_EVENT_FWD_GZ_RENAME_ERROR

Description: Event Forwarder module cannot rename event file (gz)

Severity: 7 (Medium)

Event Category: 3 (System Logs)

EventType: PH_EVENT_FWD_GZ_SIZE_MISMATCH

Description: Event Forwarder found malformed event file (gz) - length mismatch

Severity: 7 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
filePath	File Path	string

EventType: PH_EVENT_FWD_KAFKA_WARNING

Description: Event Forwarder module failed on event serialization to send via Kafka

Severity: 5 (Medium)

Event Category: 3 (System Logs)

EventType: PH_EVENT_FWD_MD5_CHECKSUM_MISMATCH

Description: Event Forwarder found event file (gz) MD5 checksum

Severity: 7 (Medium)

Event Category: 3 (System Logs)

EventType: PH_EVENT_FWD_NETFLOW_REGEX_IGNORED

Description: Event Forwarder ignores regex filter in forwarding rule for Netflow since Netflow is binary

Severity: 5 (Medium)

Event Category: 3 (System Logs)

EventType: PH_EVENT_FWD_PARTIAL_FORWARDING_FAILED

Description: Event Forwarder failed to forward a subset of events in one file to the destination. Those events will be lost

Severity: 8 (Medium)

Event Category: 3 (System Logs)

EventType: PH_EVENT_FWD_PARTIAL_FORWARDING_WARNING

Description: FortiSIEM Event Forwarder was able to do partial forwarding

Severity: 3 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
destIpAddr	Destination IP	IP	Destination IP of a device as identified in the event.
destIpPort	Destination TCP/UDP Port	uint16	This is the destination TCP or UDP port as identified in the event

EventType: PH_EVENT_FWD_PCRE_ERROR

Description: Event Forwarder module failed to Pcre compile - this means the regular expression in the forwarding rule is invalid

Severity: 7 (Medium)

Event Category: 3 (System Logs)

EventType: PH_EVENT_FWD_PROCESS_INIT_FAILED

Description: Event Forwarder failed to initialize this process

Severity: 7 (Medium)

Event Category: 3 (System Logs)

EventType: PH_EVENT_FWD_PROCESS_START_FAILED

Description: Event Forwarder failed to run

Severity: 7 (Medium)

Event Category: 3 (System Logs)

EventType: PH_EVENT_FWD_PROTO_FORWARDED_WRONG

Description: Event Forwarder found incorrect proto in the forwarding rule

Severity: 8 (Medium)

Event Category: 3 (System Logs)

EventType: PH_EVENT_FWD_RENAME_GZ_ERROR

Description: FortiSIEM Event Forwarder failed to rename gz file

Severity: 7 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
filePath	File Path	string

EventType: PH_EVENT_FWD_RULE_PARSE_ERROR

Description: Event forwarder module failed to parse event forwarding rule

Severity: 7 (Medium)

Event Category: 3 (System Logs)

EventType: PH_EVENT_FWD_SOCKET_CONNECT_FAILED

Description: Event Forwarder failed to connect the destination for TCP based forwarding

Severity: 8 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
exitValue	Command exit value	int32

EventType: PH_EVENT_FWD_SOCKET_GET_FAILED

Description: Event Forwarder failed to get socket for connecting the destination

Severity: 7 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
exitValue	Command exit value	int32

EventType: PH_EVENT_FWD_SOCKET_WRITE_FAILED

Description: Event Forwarder failed to write to socket for sending events

Severity: 7 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
exitValue	Command exit value	int32

EventType: PH_EVENT_FWD_SSL_CREATE_FAILED

Description: Event Forwarder unable to create new SSL context structure for TLS based fowarding

Severity: 7 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
errorString	Error String	string	This is the error message, synonymous to attribute errReason

EventType: PH_EVENT_FWD_SSL_SESSION_BUILD_FAILED

Description: Event Forwarder unable to build SSL session for TLS based fowarding

Severity: 7 (Medium)

Event Category: 3 (System Logs)

EventType: PH_EVENT_FWD_UNEXPECTED_FILE_REMOVED

Description: Event Forwarder removed unexpected event file (mismatched name format)

Severity: 3 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
filePath	File Path	string

EventType: PH_EVENT_PKG_ATTR_NOT_FOUND

Description: Event Packager cannot find Worker name in XML received from App Server

Severity: 7 (Medium)

Event Category: 3 (System Logs)

EventType: PH_EVENT_PKG_EMPTY_FILE_REMOVED

Description: Event Packager found an empty event file - filw will be removed

Severity: 7 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
filePath	File Path	string

EventType: PH_EVENT_PKG_FILE_ADD_TO_SVN_FAILED

Description: Event Packager failed to add configuration file to svn upload queue

Severity: 7 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
filePath	File Path	string

EventType: PH_EVENT_PKG_FILE_REMOVED_ERROR

Description: Event Packager failed to remove event file after upload

Severity: 7 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
filePath	File Path	string

EventType: PH_EVENT_PKG_FILE_RENAME_FAILED

Description: Event Packager failed to rename configuration file after scanning

Severity: 7 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
srcFilePath	Source File Path	string
destFilePath	Destination File Path	string
exitValue	Command exit value	int32

EventType: PH_EVENT_PKG_FILE_STAT_FAILED

Description: Event Packager failed to stat configuration or event file

Severity: 7 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
filePath	File Path	string
exitValue	Command exit value	int32

EventType: PH_EVENT_PKG_FILE_UPLOAD_FAILED

Description: Event Packager failed to upload event file to Worker or Super; will retry

Severity: 7 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
filePath	File Path	string
serverIpAddr	Server IP	IP

EventType: PH_EVENT_PKG_FILE_UPLOAD_SUCCESS_HIGH

Description: Event file upload success is high

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
ratio	Ratio	uint64

EventType: PH_EVENT_PKG_FILE_UPLOAD_SUCCESS_LOW

Description: Event file upload success is low

Severity: 7 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
ratio	Ratio	uint64

EventType: PH_EVENT_PKG_GZ_CLOSE_FAILED

Description: Event Packager failed to close event file after writing

Severity: 7 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
filePath	File Path	string
exitValue	Command exit value	int32

EventType: PH_EVENT_PKG_GZ_FILE_OPEN_ERROR

Description: Event Packager failed to open gz file or not enough memory to open it

Severity: 7 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
filePath	File Path	string

EventType: PH_EVENT_PKG_HTTP_FAILED

Description: Event Packager encountered HTTPS error response code

Severity: 7 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
serverIpAddr	Server IP	IP
errorNo	Error Number Unsigned	uint32	This is an unsigned integer error number

EventType: PH_EVENT_PKG_HTTP_INIT_FAILED

Description: Event Packager HTTP client initialization failed

Severity: 7 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
serverIpAddr	Server IP	IP

EventType: PH_EVENT_PKG_INSERT_TASK_FAILED

Description: Failed to insert task into event file upload queue

Severity: 5 (Medium)

Event Category: 3 (System Logs)

EventType: PH_EVENT_PKG_NO_EVENT

Description: Event Packager did not upload any event in last 10 minutes

Severity: 3 (Low)

Event Category: 3 (System Logs)

EventType: PH_EVENT_PKG_OPEN_DIR_FAILED

Description: Failed to open directory

Severity: 5 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
filePath	File Path	string
errorNoInt	Error Number Int	int32

EventType: PH_EVENT_PKG_PROCESS_INIT_FAILED

Description: Event Packager failed to initialize

Severity: 10 (High)

Event Category: 3 (System Logs)

EventType: PH_EVENT_PKG_PROCESS_START_FAILED

Description: Event Packager failed to run

Severity: 10 (High)

Event Category: 3 (System Logs)

EventType: PH_EVENT_PKG_QUEUE_GET_FAILED

Description: Event Packager failed to get event file from the queue

Severity: 7 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
exitValue	Command exit value	int32

EventType: PH_EVENT_PKG_SERVER_LIST_UPLOAD_FAILED

Description: Event Packager failed to get upload server list from App Server

Severity: 7 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
serverIpAddr	Server IP	IP

EventType: PH_EVENT_PKG_SERVICE_LIST_EMPTY

Description: Empty upload service list

Severity: 5 (Medium)

Event Category: 3 (System Logs)

EventType: PH_EVENT_PKG_TASK_ADD_TO_QUEUE_FAILED

Description: Event Packager failed to add file upload task to queue

Severity: 7 (Medium)

Event Category: 3 (System Logs)

EventType: PH_EVENT_PKG_XML_PARSE_FAILED

Description: Event Packager failed to parse XML from App Server

Severity: 7 (Medium)

Event Category: 3 (System Logs)

EventType: PH_EVTPKGER_FILE_UPLOAD_FAILED

Description: File upload failed

Severity: 6 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
fileName	File Name	string
destIpAddr	Destination IP	IP	Destination IP of a device as identified in the event.

EventType: PH_EVT_HANDLER_DBG

Description: Event handler debug message

Severity: 1 (Low)

Event Category: 3 (System Logs)

EventType: PH_EVT_HANDLER_ERR

Description: Event handler error message

Severity: 6 (Medium)

Event Category: 3 (System Logs)

EventType: PH_EVT_HANDLER_EVT_QUEUE_LARGE

Description: Uploaded event files on Worker has a size of more than 100MB

Severity: 6 (Medium)

Event Category: 3 (System Logs)

EventType: PH_EVT_HANDLER_EVT_QUEUE_WARNING

Description: Worker Input Event Queue large

Severity: 10 (High)

Event Category: 3 (System Logs)

EventType: PH_EVT_HANDLER_INFO

Description: Event handler information

Severity: 1 (Low)

Event Category: 3 (System Logs)

EventType: PH_EVT_HANDLER_SVN_QUEUE_LARGE

Description: Uploaded SVN files size large

Severity: 6 (Medium)

Event Category: 3 (System Logs)

EventType: PH_EVT_HANDLER_SVN_QUEUE_WARNING

Description: Worker Input Event Queue large

Severity: 10 (High)

Event Category: 3 (System Logs)

EventType: PH_EVT_PACKAGER_COND_WAIT_ERROR

Description: FortiSIEM Event Packager Conditional Wait Error

Severity: 7 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
errorNoInt	Error Number Int	int32

EventType: PH_EVT_PACKAGER_FILE_CLOSE_FAILURE

Description: FortiSIEM Event Packager file close error

Severity: 7 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
filePath	File Path	string
errorNoInt	Error Number Int	int32

EventType: PH_EVT_PACKAGER_FILE_OPEN_FAILURE

Description: FortiSIEM Event Packager file open error

Severity: 7 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
filePath	File Path	string

EventType: PH_EVT_PACKAGER_FILE_REMOVE_FAILURE

Description: FortiSIEM Event Packager file remove error

Severity: 7 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
filePath	File Path	string
errorNoInt	Error Number Int	int32

EventType: PH_EVT_PACKAGER_FILE_RENAME_FAILURE

Description: FortiSIEM Event Packager file rename error

Severity: 7 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
errorNoInt	Error Number Int	int32
srcFilePath	Source File Path	string
destFilePath	Destination File Path	string

EventType: PH_EVT_PACKAGER_FILE_STAT_FAILURE

Description: FortiSIEM Event Packager file stat error

Severity: 7 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
filePath	File Path	string
errorNoInt	Error Number Int	int32

EventType: PH_EVT_PACKAGER_FILE_UPLOAD_FAILURE

Description: FortiSIEM Event Packager file upload failure

Severity: 3 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
filePath	File Path	string
errorNoInt	Error Number Int	int32
destName	Destination Host Name	string	Destination device's hostname as identified in the log, can also be enriched using reverse lookup of the destination IP address.

EventType: PH_EVT_PACKAGER_HTTP_RESPONSE_ERROR

Description: FortiSIEM Event Packager http response error from App Server

Severity: 7 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
errorNoInt	Error Number Int	int32

EventType: PH_EVT_PACKAGER_INIT_FAILURE

Description: FortiSIEM Event Packager module initialization error

Severity: 10 (High)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
funName	Function Name	string
errorString	Error String	string	This is the error message, synonymous to attribute errReason

EventType: PH_EVT_PACKAGER_REST_PARSE_ERROR

Description: FortiSIEM Event Packager module failed to parse REST output

Severity: 7 (Medium)

Event Category: 3 (System Logs)

EventType: PH_EVT_PACKAGER_RUN_PROCESS_ERROR

Description: FortiSIEM Event Packager module encountered error to run process

Severity: 7 (Medium)

Event Category: 3 (System Logs)

EventType: PH_FAILED_TO_EXEC

Description: Failed to execute specified command

Severity: 6 (Medium)

Event Category: 3 (System Logs)

EventType: PH_FILE_NOT_FOUND

Description: Can not find the specified file

Severity: 7 (Medium)

Event Category: 3 (System Logs)

EventType: PH_GCS_BUCKET_ACCESS_FAILURE

Description: Failed to access GCS Bucket

Severity: 7 (Medium)

Event Category: 3 (System Logs)

EventType: PH_GENERIC_CRITICAL

Description: PH system generic critical message

Severity: 9 (High)

Event Category: 3 (System Logs)

EventType: PH_GENERIC_DEBUG

Description: PH system generic debug message

Severity: 1 (Low)

Event Category: 3 (System Logs)

EventType: PH_GENERIC_ERROR

Description: PH system generic error

Severity: 6 (Medium)

Event Category: 3 (System Logs)

EventType: PH_GENERIC_INFO

Description: PH system generic info

Severity: 1 (Low)

Event Category: 3 (System Logs)

EventType: PH_GENERIC_WARNING

Description: PH system generic warning

Severity: 5 (Medium)

Event Category: 3 (System Logs)

EventType: PH_GET_CURL_HANDLE_FAILED

Description: FortiSIEM HTTP Client failed to get handle

Severity: 7 (Medium)

Event Category: 3 (System Logs)

EventType: PH_GET_SUPER_LEADER_FAILURE

Description: Failed to get super leader IP

Severity: 7 (Medium)

Event Category: 3 (System Logs)

EventType: PH_GRPC_CERT_CREATE_SUCCESS

Description: Create gRPC certificate files

Severity: 3 (Low)

Event Category: 3 (System Logs)

EventType: PH_GRPC_CERT_ERROR

Description: 700-Grpc: Grpc cert error

Severity: 7 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
errorString	Error String	string	This is the error message, synonymous to attribute errReason

EventType: PH_GRPC_CERT_LOADED_FAILED

Description: Failed to load certs file

Severity: 7 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
errorString	Error String	string	This is the error message, synonymous to attribute errReason

EventType: PH_GRPC_CERT_UPDATE_FAILED

Description: Failed to update gRPC certificate file

Severity: 7 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
fileName	File Name	string

EventType: PH_GRPC_CERT_UPDATE_SUCCESS

Description: Updated gRPC certificate file

Severity: 3 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
fileName	File Name	string

EventType: PH_GRPC_FORTMAT_JSON_FAILED

Description: Failed to format Json response

Severity: 7 (Medium)

Event Category: 3 (System Logs)

EventType: PH_GRPC_TASK_DATA_EMPTY

Description: GRPC task is empty

Severity: 7 (Medium)

Event Category: 3 (System Logs)

EventType: PH_HDFS_ARCHIVE_STORAGE_LOW

Description: The available storage of HDFS Archive database is low

Severity: 3 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
totalDiskMB	Total Disk MB	uint32
freeDiskMB	Free Disk MB	uint32

EventType: PH_HDFS_ARCHIVE_STORAGE_USAGE

Description: Storage usage of HDFS Archive database

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
totalDiskMB	Total Disk MB	uint32
freeDiskMB	Free Disk MB	uint32

EventType: PH_HDFS_PURGING_FAILED

Description: Failed purging from HDFS Archive database

Severity: 10 (High)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
errReason	Reason for Error	string	This is the reason for an error if given.

EventType: PH_HDFS_PURGING_FINISHED

Description: Finished purging from HDFS Archive database - triggered by low space

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
totBytes64	Total Bytes64	uint64	Total number of sent and received bytes by a host. This has 64bit resolution.

EventType: PH_HDFS_PURGING_STARTED

Description: Started purging from HDFS Archive database - triggered by low space

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
totBytes64	Total Bytes64	uint64	Total number of sent and received bytes by a host. This has 64bit resolution.

EventType: PH_HDFS_PURGING_SUCCESS

Description: Successfully purged from HDFS Archive database - triggered by low space

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
totBytes64	Total Bytes64	uint64	Total number of sent and received bytes by a host. This has 64bit resolution.

EventType: PH_HTTP_CLIENT_COMPRESS_FAILED

Description: FortiSIEM HTTP Client failed to compress payload

Severity: 7 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
errReason	Reason for Error	string	This is the reason for an error if given.

EventType: PH_HTTP_CLIENT_CURL_ERROR

Description: FortiSIEM HTTP Client failed with curl error

Severity: 7 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
infoURL	Informational URL	string	This field captures an URL if present in an event

EventType: PH_HTTP_CLIENT_GET_CACHE_FROM_MONITOR_FAILED

Description: FortiSIEM HTTP Client failed to get cache

Severity: 7 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
errReason	Reason for Error	string	This is the reason for an error if given.

EventType: PH_HTTP_CLIENT_GET_DATA_FROM_CACHE_FAILED

Description: FortiSIEM HTTP Client failed to get data from cache

Severity: 7 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
errReason	Reason for Error	string	This is the reason for an error if given.

EventType: PH_HTTP_CLIENT_GET_INIT_RESPONSE_FAILED

Description: FortiSIEM HTTP Client failed to get initialization response

Severity: 5 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
infoURL	Informational URL	string	This field captures an URL if present in an event
errorNoInt	Error Number Int	int32
errorString	Error String	string	This is the error message, synonymous to attribute errReason

EventType: PH_HTTP_CLIENT_GET_INIT_RESPONSE_WARNING

Description: FortiSIEM HTTP Client encountered error getting initialization response

Severity: 3 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
infoURL	Informational URL	string	This field captures an URL if present in an event
errorNoInt	Error Number Int	int32
errorString	Error String	string	This is the error message, synonymous to attribute errReason

EventType: PH_HTTP_CLIENT_GET_RESPONSE_WARNING

Description: FortiSIEM HTTP Client encountered error getting response

Severity: 3 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
infoURL	Informational URL	string	This field captures an URL if present in an event

EventType: PH_HTTP_CLIENT_HOST_IS_NULL

Description: FortiSIEM HTTP Client host is null error

Severity: 7 (Medium)

Event Category: 3 (System Logs)

EventType: PH_HTTP_CLIENT_INIT_FAILURE

Description: FortiSIEM HTTP Client initialization failure

Severity: 10 (High)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
serverIpAddr	Server IP	IP

EventType: PH_HTTP_CLIENT_INIT_WARNING

Description: FortiSIEM HTTP Client initialization warning

Severity: 3 (Low)

Event Category: 3 (System Logs)

EventType: PH_HTTP_CLIENT_INVALID_FILE_SIZE

Description: FortiSIEM HTTP Client encoutered invalid file size

Severity: 7 (Medium)

Event Category: 3 (System Logs)

EventType: PH_HTTP_CLIENT_MKSTEMP_FAILED

Description: FortiSIEM HTTP Client failed to mkstemp

Severity: 7 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
fileName	File Name	string

EventType: PH_HTTP_CLIENT_NO_FILE_PARAM

Description: FortiSIEM HTTP Client missing file paarameter

Severity: 7 (Medium)

Event Category: 3 (System Logs)

EventType: PH_HTTP_CLIENT_PICK_SUPER_FAILED

Description: FortiSIEM HTTP Client failed to pick super

Severity: 7 (Medium)

Event Category: 3 (System Logs)

EventType: PH_HTTP_CLIENT_PREP_REQUEST_ERROR

Description: FortiSIEM HTTP Client Prep Request error

Severity: 7 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
errReason	Reason for Error	string	This is the reason for an error if given.

EventType: PH_HTTP_CLIENT_PUT_REDIRECT_FAILURE

Description: FortiSIEM HTTP Client PUT Redirect error

Severity: 7 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
errReason	Reason for Error	string	This is the reason for an error if given.

EventType: PH_HTTP_CLIENT_SETOPT_FAILED

Description: FortiSIEM HTTP Client setopt call failed

Severity: 7 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
errorNoInt	Error Number Int	int32
errorString	Error String	string	This is the error message, synonymous to attribute errReason

EventType: PH_HTTP_CLIENT_SET_HOST_WARNING

Description: FortiSIEM HTTP Client set host call failed

Severity: 3 (Low)

Event Category: 3 (System Logs)

EventType: PH_HTTP_CLIENT_UPLOAD_FILE_FAILED

Description: FortiSIEM HTTP Client file upload failed

Severity: 7 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
serverIpAddr	Server IP	IP
infoURL	Informational URL	string	This field captures an URL if present in an event
httpStatusCode	HTTP Status	string
errorNoInt	Error Number Int	int32

EventType: PH_HTTP_CLIENT_WRITE_CACHE_NULL

Description: FortiSIEM HTTP Client cache write error

Severity: 7 (Medium)

Event Category: 3 (System Logs)

EventType: PH_HTTP_INIT_FAILURE

Description: Http client initialization failure

Severity: 6 (Medium)

Event Category: 3 (System Logs)

EventType: PH_HTTP_RESPONSE_FAILURE

Description: HTTP response code failure

Severity: 3 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
errorNo	Error Number Unsigned	uint32	This is an unsigned integer error number

EventType: PH_IDENTITYMASTER_HTTP_UPLOAD_ERROR

Description: Identity Master failed to upload identity location information to App server

Severity: 10 (High)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
errorNo	Error Number Unsigned	uint32	This is an unsigned integer error number
errReason	Reason for Error	string	This is the reason for an error if given.

EventType: PH_IDENTITYMASTER_INIT_ERROR

Description: Identity Master initialization error

Severity: 10 (High)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
errReason	Reason for Error	string	This is the reason for an error if given.

EventType: PH_IDENTITYWORKER_ATTRIB_ERROR

Description: Identity Worker found invalid event attribute in identyDef.xml

Severity: 9 (High)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
errReason	Reason for Error	string	This is the reason for an error if given.

EventType: PH_IDENTITYWORKER_EVT_LOAD_ERROR

Description: Identity Worker failed to load event from shared store

Severity: 10 (High)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
errReason	Reason for Error	string	This is the reason for an error if given.

EventType: PH_IDENTITYWORKER_EVT_SEND_ERROR

Description: Identity Worker failed to send event to Identity Master

Severity: 10 (High)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
errReason	Reason for Error	string	This is the reason for an error if given.
sentBytes64	Sent Bytes64	uint64	Number of bytes sent by a host. This has 64bit resolution.

EventType: PH_IDENTITYWORKER_INIT_ERROR

Description: Identity Worker initialization error

Severity: 10 (High)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
errReason	Reason for Error	string	This is the reason for an error if given.

EventType: PH_IDENTITYWORKER_PARAM_ERROR

Description: Identity Worker configuration parameter undefined in phoenix_config.txt

Severity: 7 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
errReason	Reason for Error	string	This is the reason for an error if given.

EventType: PH_IDENTITYWORKER_PROCESSING_EPS

Description: IP Identity Worker EPS statistics

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
eventsPerSec	Event Rate	double	A generic attribute for recording event ingestion or handling rate.

EventType: PH_IDENTITYWORKER_SS_OBTAIN_ERROR

Description: Identity Worker failed to create shared store

Severity: 10 (High)

Event Category: 3 (System Logs)

EventType: PH_INCIDENT_ACTION_STATUS

Description: Record action result for incident notification

Severity: 1 (Low)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
scriptOutput	Script Output	string

EventType: PH_INVALID_IP_ADDR

Description: FortiSIEM backend module detected invalid IP address

Severity: 7 (Medium)

Event Category: 3 (System Logs)

EventType: PH_INVALID_PARAM

Description: Invaid Parameter

Severity: 6 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
paraName	Param Name	string

EventType: PH_INVALID_PARAM_CNT

Description: Invaid number of parameter

Severity: 6 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
count	Count	uint32	A general count variable. A common use case is for incidents. Count represents how many times an Incident occurred in a time interval. When an Incident with the same group by parameters occurs again. The count is incremented and the Last Seen time is advanced. Count can be used for other events also.

EventType: PH_INVALID_PARAM_VAL_EMPTY

Description: Invalid empty parameter value

Severity: 6 (Medium)

Event Category: 3 (System Logs)

Attributes:

Id	Display name	Type	Description
paraName	Param Name	string

EventType: PH_JAVA_AGENT_APPSERVER_CONN_ERROR

Description: FSM FSM Java Agent failed to connect to App Server

Severity: 7 (Medium)

Event Category: 3 (System Logs)

EventType: PH_JAVA_AGENT_APPSERVER_EXECUTE_ERROR

Description: FSM FSM Java Agent app server JMX Pull SQL Error

Severity: 7 (Medium)

Event Category: 3 (System Logs)

EventType: PH_JAVA_AGENT_CONTROLLER_CMD_PARSE_ERROR

Description: FSM Java Agent parse file failed

Severity: 7 (Medium)

Event Category: 3 (System Logs)

EventType: PH_JAVA_AGENT_CONTROLLER_CMD_READ_ERROR

Description: FSM Java Agent control channel problem, exiting ...

Severity: 7 (Medium)

Event Category: 3 (System Logs)

EventType: PH_JAVA_AGENT_CONTROLLER_GENERIC_ERROR

Description: FSM Java Agent parse file failed

Severity: 7 (Medium)

Event Category: 3 (System Logs)

EventType: PH_JAVA_AGENT_CONTROLLER_LINE_READ_ERROR

Description: FSM Java Agent hit exception while reading line type

Severity: 7 (Medium)

Event Category: 3 (System Logs)

EventType: PH_JAVA_AGENT_CONTROLLER_XML_READ_ERROR

Description: FSM Java Agent hit exception while reading command XML from App Server

Severity: 7 (Medium)

Event Category: 3 (System Logs)

EventType: PH_JAVA_AGENT_CUSTOM_JDBC_CONN_ERROR

Description: FSM Java Agent failed to execute custom JDBC monitoring job - connection error

Severity: 7 (Medium)

Event Category: 3 (System Logs)

EventType: PH_JAVA_AGENT_CUSTOM_JDBC_EXEC_ERROR

Description: FSM Java Agent failed to execute custom JDBC monitoring job - execution error

Severity: 7 (Medium)

Event Category: 3 (System Logs)

EventType: PH_JAVA_AGENT_DISCOVERY_TEST_ERROR

Description: FSM Java Agent failed to connect to Snort database for testing

Severity: 7 (Medium)

Event Category: 3 (System Logs)

EventType: PH_JAVA_AGENT_ERROR

Description: PH java agent generic error

Severity: 6 (Medium)

Event Category: 3 (System Logs)

EventType: PH_JAVA_AGENT_GLASSFISH_MONITOR_ERROR

Description: FSM Java Agent GlassFish monitoring failure

Severity: 7 (Medium)

Event Category: 3 (System Logs)

EventType: PH_JAVA_AGENT_GLASS_FISH_WARNING

Description: FSM Java Agent GlassFish monitoring warning

Severity: 7 (Medium)

Event Category: 3 (System Logs)

EventType: PH_JAVA_AGENT_GOOGLEAPPS_EXEC_ERROR

Description: FSM Java Agent Google Apps Monitor Exception

Severity: 7 (Medium)

Event Category: 3 (System Logs)

EventType: PH_JAVA_AGENT_IBMDB2_AUDIT_CONN_ERROR

Description: FSM Java Agent IBM DB2 connection error

Severity: 7 (Medium)

Event Category: 3 (System Logs)

EventType: PH_JAVA_AGENT_IBMDB2_AUDIT_EXEC_ERROR

Description: FSM Java Agent IBM DB2 audit error

Severity: 7 (Medium)

Event Category: 3 (System Logs)

EventType: PH_JAVA_AGENT_IBM_DB2_CAT_READ_ERROR

Description: FSM Java Agent IBM loading error

Severity: 7 (Medium)

Event Category: 3 (System Logs)

EventType: PH_JAVA_AGENT_IBM_DB2_CONN_ERROR

Description: FSM Java Agent failed to connect to IBM DB2 for collecting audit logs

Severity: 7 (Medium)

Event Category: 3 (System Logs)

EventType: PH_JAVA_AGENT_IBM_DB2_INTERNAL_ERROR

Description: FSM Java Agent IBM Sleep Interrupted error

Severity: 7 (Medium)

Event Category: 3 (System Logs)

EventType: PH_JAVA_AGENT_INFO

Description: PH java agent generic info

Severity: 1 (Low)

Event Category: 3 (System Logs)

EventType: PH_JAVA_AGENT_JBOSS_CONN_ERROR

Description: FSM Java Agent app server connection error

Severity: 7 (Medium)

Event Category: 3 (System Logs)

EventType: PH_JAVA_AGENT_JBOSS_EXEC_ERROR

Description: FSM Java Agent app server connection error

Severity: 7 (Medium)

Event Category: 3 (System Logs)

EventType: PH_JAVA_AGENT_JBOSS_MONITOR_ERROR

Description: Fail to monitor Jboss

Severity: 7 (Medium)

Event Category: 3 (System Logs)

EventType: PH_JAVA_AGENT_JDBC_PULL_UNSUPP_ERROR

Description: No connection for job when pulling JDBC

Severity: 7 (Medium)

Event Category: 3 (System Logs)

EventType: PH_JAVA_AGENT_JDBC_SQL_NOT_SUPPORT_ERROR

Description: FSM Java Agent cannot support such a SQL

Severity: 7 (Medium)

Event Category: 3 (System Logs)

EventType: PH_JAVA_AGENT_JMX_CONN_ERROR

Description: FSM Java Agent jmx JDBC error

Severity: 7 (Medium)

Event Category: 3 (System Logs)

EventType: PH_JAVA_AGENT_JMX_EXEC_ERROR

Description: FSM Java Agent JMX monitor error

Severity: 7 (Medium)

Event Category: 3 (System Logs)

EventType: PH_JAVA_AGENT_JOB_EXECUTOR_ERROR

Description: Exception in AgentJobExecutor.run error

Severity: 7 (Medium)

Event Category: 3 (System Logs)

EventType: PH_JAVA_AGENT_JOB_STATUS_UPLOAD_ERROR

Description: Failed to upload job status xml

Severity: 7 (Medium)

Event Category: 3 (System Logs)

EventType: PH_JAVA_AGENT_JOB_TYPE_ERROR

Description: AgentUtils createAndInitAgent serverType is not defined

Severity: 7 (Medium)

Event Category: 3 (System Logs)

EventType: PH_JAVA_AGENT_JOB_XML_LOAD_ERROR

Description: Exception caught while parsing JobXml

Severity: 7 (Medium)

Event Category: 3 (System Logs)

EventType: PH_JAVA_AGENT_JOB_XML_PARSE_ERROR

Description: Exception caught while parsing JobXml

Severity: 7 (Medium)

Event Category: 3 (System Logs)

EventType: PH_JAVA_AGENT_MCAFEE_MYSQL_MONITOR_ERROR

Description: FSM Java Agent my sql performance monitor error

Severity: 7 (Medium)

Event Category: 3 (System Logs)

EventType: PH_JAVA_AGENT_MCAFEE_VULN_SCANNER_ERROR

Description: FSM Java Agent vulnerability pulling error

Severity: 7 (Medium)

Event Category: 3 (System Logs)

EventType: PH_JAVA_AGENT_MONITOR_GEN_ERROR

Description: FSM Java Agent job monitor rest error

Severity: 7 (Medium)

Event Category: 3 (System Logs)

EventType: PH_JAVA_AGENT_MONITOR_TIMEOUT_ERROR

Description: FSM Java Agent job monitor execute too long

Severity: 7 (Medium)

Event Category: 3 (System Logs)

EventType: PH_JAVA_AGENT_MSSQL_DDL_CONN_ERROR

Description: FSM Java Agent JDBC pull don't support dev error

Severity: 7 (Medium)

Event Category: 3 (System Logs)

EventType: PH_JAVA_AGENT_MSSQL_LOGON_CONN_ERROR

Description: FSM Java Agent MySql Connection error

Severity: 7 (Medium)

Event Category: 3 (System Logs)

EventType: PH_JAVA_AGENT_MSSQL_LOGON_EXEC_ERROR

Description: FSM Java Agent app server JMX Pull SQL Error

Severity: 7 (Medium)

Event Category: 3 (System Logs)

EventType: PH_JAVA_AGENT_MSSQL_MONITOR_ERROR

Description: FSM Java Agent ms sql performance error

Severity: 7 (Medium)

Event Category: 3 (System Logs)

EventType: PH_JAVA_AGENT_MSSQL_PERF_CONN_ERROR

Description: FSM Java Agent job connection error

Severity: 7 (Medium)

Event Category: 3 (System Logs)

EventType: PH_JAVA_AGENT_MSSQL_PERF_EXECUTE_ERROR

Description: FSM Java Agent MSSQL job execution error

Severity: 7 (Medium)

Event Category: 3 (System Logs)

EventType: PH_JAVA_AGENT_MYSQL_PERF_CONN_ERROR

Description: FSM Java Agent MYSQL connection error

Severity: 7 (Medium)

Event Category: 3 (System Logs)

EventType: PH_JAVA_AGENT_MYSQL_PERF_EXEC_ERROR

Description: FSM Java Agent mysql audit performance error

Severity: 7 (Medium)

Event Category: 3 (System Logs)

EventType: PH_JAVA_AGENT_NESSUS_REPORT_PARSE_ERROR

Description: FSM Java Agent nessus report parse error

Severity: 7 (Medium)

Event Category: 3 (System Logs)

EventType: PH_JAVA_AGENT_ORACLE_DB_ERROR

Description: FSM Java Agent Oracle DB performance metrics error

Severity: 7 (Medium)

Event Category: 3 (System Logs)

EventType: PH_JAVA_AGENT_ORADB_AUDIT_CONN_ERROR

Description: FSM Java Agent Oracle DB connection error

Severity: 7 (Medium)

Event Category: 3 (System Logs)

EventType: PH_JAVA_AGENT_ORADB_AUDIT_EXEC_ERROR

Description: FSM Java Agent Oracle DB execution error

Severity: 7 (Medium)

Event Category: 3 (System Logs)

EventType: PH_JAVA_AGENT_ORADB_LOGON_EXEC_ERROR

Description: FSM Java Agent Oracle Audit trail pull error

Severity: 7 (Medium)

Event Category: 3 (System Logs)

EventType: PH_JAVA_AGENT_ORADB_PERF_CONN_ERROR

Description: FSM Java Agent Oracle Database performance metrics collection error - connection issue

Severity: 7 (Medium)

Event Category: 3 (System Logs)

EventType: PH_JAVA_AGENT_ORADB_PERF_EXEC_ERROR

Description: FSM Java Agent Oracle Database performance metrics collection error - SQL exec error

Severity: 7 (Medium)

Event Category: 3 (System Logs)

EventType: PH_JAVA_AGENT_SNORT_CONN_ERROR

Description: FSM Java Agent Snort IPS connect error

Severity: 7 (Medium)

Event Category: 3 (System Logs)

EventType: PH_JAVA_AGENT_SNORT_EVENTID_ERROR

Description: FSM Java Agent Snort IPS alert collection error - exception in setMaxEventId function

Severity: 7 (Medium)

Event Category: 3 (System Logs)

EventType: PH_JAVA_AGENT_SNORT_EXEC_ERROR

Description: FSM Java Agent Snort IPS alert collection error

Severity: 7 (Medium)

Event Category: 3 (System Logs)

EventType: PH_JAVA_AGENT_SNORT_SENSORID_ERROR

Description: FSM Java Agent Snort IPS alert collection error - exception in setSensorId2MaxEventId function

Severity: 7 (Medium)

Event Category: 3 (System Logs)