Monitoring and reports

ReadyView shows a firewall's health in two places:

• the firewall's Overview tab, for that one firewall;
• the Firewall section of the site's dashboard, one card per firewall in the site.

Monitoring needs no setting on the firewall. It works as soon as the firewall is claimed. Changing a firewall's alerts needs permission to change firewalls.

#Overview tab

The Overview tab shows the firewall at a glance. Readings arrive about every 15 seconds.

• CPU, Memory, and Uptime gauges.
• Device Information: model, MAC address, serial number, software and operating system versions, memory, disk, the state table limit, and when ReadyView last heard from the firewall.
• Gateways: each gateway's address and status. Green is online, amber is losing packets or slow, and red is down.
• Uplinks (plugin 1.11 or later): which uplink carries traffic now, for example "Traffic is on the backup uplink, WAN2, because the main uplink isn't working." See Internet uplinks.
• Interfaces: each port and VLAN with its link, addresses, and live traffic in and out. VLANs are indented under their port.
• Recent Events: today's latest events.
• Alerts and WAN connectivity, described below.

#WAN connectivity

WAN connectivity shows uptime bars for the last day (1D) or week (1W):

• Internet: whether the firewall could reach Cloudflare, Google, and Quad9 through its default uplink. It checks every 15 seconds.
• One row per gateway, with its uptime.

Each slot is Connected, Packet loss (5% loss or more, or any down time), Down (down for at least 10% of the slot, or 50% loss or more), Not monitored, or No data. Hover over a slot for its latency, loss, or down time.

Gateway rows need gateway monitoring. A gateway without it shows Not monitored. Turn monitoring on in Uplinks.

#Site dashboard

On the site's dashboard, the Firewall section has a card for each firewall in the site:

• Summary: gateway IP, uptime, software version, CPU and memory, and how many connections the firewall is tracking against its limit (Firewall States).
• Per WAN: status, link speed, IPv4 and IPv6 addresses, live throughput, and a Speed test. A Private tag on the WAN address means the firewall sits behind another router or carrier-grade NAT.
• Monthly Data Usage: download plus upload for the calendar month, in the firewall's time zone.
• Latency to Cloudflare, Google, and Quad9, and each gateway's latency and loss.
• Internet Activity: download and upload over the last 5 minutes, live while you watch.
• WAN Health: totals and charts over the last hour, day, week, or month. Gateway latency and packet loss and WAN throughput chart each monitored gateway.
• Traffic: totals, Top Apps, Top Clients, and Top Destinations for the same range.

#Speed test

Each WAN that's up has a Speed test. Click Run to measure the connection against Cloudflare's speed test: 10 seconds of download, then 10 seconds of upload. It fills the connection for about 22 seconds, so anyone using it will notice. Results show only while the page is open; each run is recorded in the organization's Logs.

For more options, such as upload only or a longer test, use Tools > Ping, traceroute and DNS. See Tools. If Cloudflare limits the test, see Troubleshooting.

#Alerts

The Alerts card on the Overview tab lists the firewall's active alerts, most serious first. Each alert shows when it started, the reading that raised it, and a What it means and how to fix it guide.

An alert is raised when a problem lasts as long as its setting says, and it clears by itself once things recover. Raised and cleared alerts are also logged with the firewall's events.

#Alert settings

Click Alert settings on the card to change them. Every alert is on by default.

Click Save. Alerts use the new settings within about two minutes. Restore defaults puts every setting back.

Gateway alerts need gateway monitoring. Threat protection alerts are set in Threat protection, and warm spare alerts in Warm spare.

#Get alerts by email or webhook

To be notified when a firewall raises or clears an alert, turn on Firewall Alerts under Settings > Notifications and choose the recipients, or a webhook for Slack, Discord, or Teams. Firewalls going offline are notified under Device Offline. See Alerts and notifications.

#Security report

The security report sums up what a firewall blocked, how its internet connection held up, and what changed. Open it from the firewall's Activity > Security report.

1. Choose a range: 24 hours, 7 days (the default), 14 days, 30 days, or Custom (up to 30 days, within the last 400).
2. Read the totals at the top: threats and DNS lookups blocked, WAN uptime and failovers, alerts, configuration changes, reboots, data used, and peak CPU and memory.
3. Open the sections for detail:
   • Threats blocked, by threat blocklists, region filter, and DNS filter, with the most blocked domains;
   • Traffic;
   • WAN uptime, with each gateway's outages and failovers;
   • Alerts;
   • Configuration changes: From ReadyView, Outside ReadyView, and Put back by the firewall;
   • Health: CPU, memory, connections, and reboots.
4. Click Save as PDF to download it, for example for a monthly customer report.

Times are in your own time zone. A "+" after a number means "at least this many". When the firewall didn't report for part of the range, the report says its figures are a minimum.

Threat, DNS, and reboot figures come from the firewall itself and need plugin 1.11 or later. DNS lookups are only counted when Unbound DNS statistics are on, under Services > Unbound DNS on the firewall.

#Organization summary

The Firewall security summary adds the same figures up across every firewall in your organization, with a row per firewall. Open Metrics from the header menu, then click Show summary on the Firewall security summary card. It asks each firewall for its own figures, so it takes a few seconds. It covers up to 100 firewalls, by name.

Tick Email me this summary every week to get it every week, covering the last 7 days.