Alert when bandwidth threshold exceeded

cmc

Is there a way to send an email alert when a specified bandwidth threshold is exceeded for an interface, or alternatively, for a host?

james.carson

Hi @cmc

The bandwidth limit/reservations and quotas only output data into reports for the most part.

You can enable email notifications for any log message. However, you will get all messages of this type, and not one specific to any user.

The firewall does produce a log like this:

LogID: 3000-0065
Example: User James@Firebox-DB used 21 MB of the bandwidth quota (100 MB) and used 1 minute of the time quota (3 minutes).

See:
(Enable Notification for Specific Messages)
https://www.watchguard.com/help/docs/help-center/en-US/Content/en-US/Fireware/fsm/enable_notification_messages_wsm.html

I would suggest looking at scheduled reports, which can provide the data you're looking for on a timed interval (like daily:)

Denied Quota
Summary of the denied traffic by hits for users who exceed the bandwidth and time quotas configured on your device.

Includes the name of the user, the count of user attempts to connect, and the percentage of denied connections for each user.

To include this report in a schedule, select the Exceptions > Denied Quota Summary report.

Authentication - Allowed
Summary of all users who successfully authenticated to the device. Includes the login time, logout time, duration, and connection method. If bandwidth and time quotas are enabled on your Firebox, the quota usage details also appear for each user.

To include this report in a schedule, select the Firebox Reports > User Authentication report.

See:
(About Dimension Reports)
https://www.watchguard.com/help/docs/help-center/en-US/Content/en-US/Fireware/dimension/reports_report-list_d.html