Configure Alert Settings

This alert type will send out alerts when download usage exceeds certain thresholds over time.

Set an alert for 85% of the total download amount possible on the internet connection over 10 minutes and if this triggers often, a bandwidth limiter may be useful.

• MB: The maximum amount of data usage, in megabytes, permitted before the alert is triggered.
• kbps: The average data transfer rate, in kilobits per second, permitted before the alert is triggered.

The Smoothwall Filter and Firewall calculates the bandwidth used to two decimal places.

Similar to the web filter violations alerts, we also have one for the firewall. Again we have two thresholds available, this time called warning and incident. These alerts trigger on both blocked and logged traffic so make sure traffic auditing is not enabled or threshold values are adjusted appropriately, in the "Network - Settings - Advanced" menu, as the alert might otherwise trigger too often. Again a useful alert if you suspect a system is spamming access requests to a blocked or unavailable destination.

• Monitor source (remote) IP addresses: Detects suspicious inbound communication from remote IP addresses. Alerts are generated if a rapid series of inbound requests from the same remote IP address is detected.
• Monitor source (remote) ports: Detects suspicious inbound communication from remote ports. Alerts are generated if a rapid series of inbound requests from the same remote port is detected.
• Monitor destination (local) IP addresses: Detects suspicious inbound communication to local IP addresses. Alerts are generated if a rapid series of inbound requests to the same local IP address is detected.
• Monitor destination (local) ports: Detects suspicious inbound communication to local ports. Alerts are generated if a rapid series of inbound requests to the same local port is detected.

This is meant for monitoring external services, not the Smoothwall Filter and Firewall itself.

You can add a website address (you can omit http:// when entering the URL) and the monitoring system accesses the URL, checks for the presence of particular keywords and if those are not found or access fails outright, it generates an alert.

The Other services is used to check access to SSH or RDP servers, for example. If connection fails, it generates an alert. You can do a DNS resolution test for a specific address, which triggers an alert if the resolution fails or is different from the expected result. Select "Other" for the Protocol to see if there's any response to connections on the associated port.

The system resource monitor will trigger when load average, memory or disk usage climbs above a certain threshold in a 5 minute period.

The load average value has to be adjusted for the appliance and workload in use - in general for the load average value, set this to the number of CPUs in the system or 10, whatever is the lowest.

A system operating at normal performance should record a load average of between 0.0 and 1.0. While higher values are not uncommon, prolonged periods of high load (for example, averages greater than 3.0) might merit attention.

Memory and disk should be set about the 90% mark. If the load average alert triggers often, it may be time to look at some of the services and adjust the workload that the Smoothwall Filter and Firewall is asked to manage.

This alert is a bit more specific in that you have to configure target URL and domains. If a user or IP address tries to access any of those, an alert gets generated. In this alert we also have two thresholds that can be used.

The URL, or part of a URL, to monitor and you must enter these on separate lines. For example, these:

http://www.example.com
example.com
real

would match: http://www.example.com/we%20are%20not%20real