System Behavioural Checks
System checks are designed to spot ntopng problems and thus make sure the application is healthy.
BGP Prefix Update
Checks for BGP prefix updates.
The alert is sent for every BGP prefix update notification received by ntopng (announcements and withdrawals of prefixes).
Interface: Packet & ZMQ
Category: Internals
Not Enabled by Default
Disk Space Low
Checks the free disk space.
The alert is sent when the used space on the ntopng data volume (or on the traffic recording volume, when it is separate) exceeds the configured threshold (default: 90%). The alert is released when the used space goes back under the threshold. Not available on Windows.
Interface: Packet & ZMQ
Category: System
Enabled by Default
Exporters Limit Exceeded
Checks for a the number of exporters.
Each ntopng license supports up to a specific number of exporters.
The alert is sent when there are more exporters than the number supported by the license.
Interface: Packet & ZMQ
Category: Internals
Enabled by Default
Intrusion Detection and Prevention Log
Checks for Intrusion Detection and Prevention logs.
Ntopng notifies when a host has been added or removed from the jailed hosts pool.
The Alert is sent when unusual logged events are detected.
Interface: Packet & ZMQ
Category: Internals
Not Enabled by Default
Periodic Activity Not Executed
Checks for periodic activity execution.
The system sends an alert when a periodic activity is queuing and is not getting executed.
The alert is sent when the worker threads are busy.
Interface: Packet & ZMQ
Category: Internals
Enabled by Default
Redis Reads Writes Exceeded
Checks the number of Redis operations.
The alert is sent when the number of Redis read and write operations in the last 24 hours is anomalous compared to the rest of the week.
Interface: Packet & ZMQ
Category: Internals
Enabled by Default
Slow Periodic Activity
Checks for slow periodic activity.
A periodic activity is taking time to start the execution.
The alert is sent to notify that a periodic activity takes too long.
Interface: Packet & ZMQ
Category: Internals
Enabled by Default
System Alerts Drops
Checks for a system alerts drops.
Too many alerts are generated in a short period of time, this may cause the system dropping the alerts.
The alert is sent when there is no room in the internal alerts queue and the alerts are dropped.
Interface: Packet & ZMQ
Category: Internals
Enabled by Default
System Error
Checks for a system errors.
Trigger an alert when a system error (ntopng failure) is detected.
Interface: Packet & ZMQ
Category: Internals
Enabled by Default
Always Enabled System Alerts
The following alerts are not generated by a Check, so they are not listed in the Behavioral Checks page. They are enabled by default and cannot be disabled.
Process
The alert (process_notification) is sent when ntopng starts or stops.
Always Enabled, cannot be disabled
Login Failed
The alert (login_failed) is sent when a login to the web GUI fails.
Always Enabled, cannot be disabled
User Activity
The alert (user_activity) is sent when a user performs an activity related to system management and security (see Alerts, User Activities).
Always Enabled, cannot be disabled
Endpoint Shell Script Executed
The alert (shell_script_executed) is sent when the Shell Script endpoint runs a script.
Always Enabled, cannot be disabled
Fail2Ban Command Executed
The alert (fail2ban_executed) is sent when the Fail2Ban endpoint runs a command.
Always Enabled, cannot be disabled
Misconfigured App
The alert (misconfigured_app) is sent when the ntopng configuration is not adequate, for example when there are more hosts or flows than the -x / -X limits.
Always Enabled, cannot be disabled
Packets Queue Flushed
The alert (nfq_flushed) is sent when the NFQUEUE packets queue of an interface is flushed because it is full.
Always Enabled, cannot be disabled
List Download Failed
The alert (list_download_failed) is sent when a blacklist or category list cannot be downloaded.
Always Enabled, cannot be disabled
List Download Succeeded
The alert (list_download_succeeded) is sent when a blacklist or category list is downloaded and updated.
Always Enabled, cannot be disabled
Gateway Unreachable
The alert (gateway_unreachable) is sent when a gateway does not answer to ping (nEdge only).
Always Enabled, cannot be disabled
Misconfigured DHCP Range
The alert (ip_outsite_dhcp_range) is sent when a device gets an IP address outside the configured DHCP range.
Always Enabled, cannot be disabled