Technical Tip: How to view which interface shows as down in 360 Protection Report

Description

This article describes how to view each FortiGate interface that shows as down in the default 360 Protection Report. By default, the template report only shows the quantity interface that is 'down' under Interface Performance -> Interface Down Events.

Scope

FortiAnalyzer.

Solution

Since the data reports are populated from the logs received from the FortiGate, it can view this information from the logs themselves, which is under the Log View.

To get this information correctly captured, check the Dataset on which the Log Type needs to be viewed in the Log View. By checking the Report -> Report Definitions -> 'any' 360 Protection Report -> Editor -> Select 3.1 Interface Down Events.

Notice the default chart value used to populate the output for Top 10 Network Interface Availability Faults By Device, which is using the default chart Top 10 FortiGate Interface Down Count Over Time.

Proceed to check the dataset by going to Reports -> Report Definitions -> Chart Library -> Select Search Top 10 FortiGate Interface Down Count Over Time -> Dataset: fgt-intf-down-dev -> Select the Edit icon.

From the default dataset value for fgt-intf-down-dev, it is using Event logs, and further information can be used is the Status = Down with Log ID = 20099.

With this information, go to Log View -> Logs -> Fortinet Logs -> Event: System, and filter with the same value as the report, such as Device and Time Period. Proceed to use the filter function to view the value more accurately, and it will show which interface is down.

Another option was to use a custom dataset and chart to populate in the report, and for this documentation, the dataset shared is an example. Note that general TAC does not support any custom dataset, chart, or report. 

Technical Tip: FortiCare Technical Support eligibility by feature and product

Create a dataset based on below SQL query:

select
      devname,
      interface
from
(
      select
            devname,
            replace(regexp_substr(msg, 'Interface [^ ]+'), 

            'Interface ', 

            ''

          ) as interface
      from
           $log
      where
           $filter
           and logid_to_int(logid)= 20099
           and status = 'DOWN'
      order by
           devname
) t
group by
         devname,
         interface
order by
         devname,
         interface

Use the dataset in a chart, and add it to the report. Make sure to clone 360 Protection Report to add the chart.