Technical Tip: Collecting EMS v7.4 logs manually when the EMS GUI is unreachable

Prerequisites:

• Ensure SSH access is available to the EMS server.
• It will be necessary to have sudo privileges to execute the commands and access the log directories.

Steps to connect and collect logs:

• Use SSH to connect to the EMS server. Replace the 'username' with the actual username and the 'EMS_IP' with the IP address of the EMS server.

ssh username@EMS_IP

• After connecting, execute the following commands to gather EMS, PostgreSQL, Redis, UFW, and system-related logs. These commands will save the log files in the /tmp/ directory for easy retrieval.

EMS logs:

sudo tar -czf /tmp/fortiems_logs.tar.gz /var/log/forticlientems/

Apache logs:

sudo tar -czf /tmp/apache_logs.tar.gz /var/log/apache2

PostgreSQL logs:

sudo tar -czf /tmp/postgresql_logs.tar.gz /var/log/postgresql/

Redis logs:

sudo tar -czf /tmp/redis_logs.tar.gz /var/log/redis/

UFW (firewall) logs:

sudo journalctl -u ufw --since -10d > /tmp/ufw_logs.txt

VM system logs:

sudo journalctl -x --since -10d > /tmp/system_logs.txt

EMS diagnostic tool log generator:
This binary file is located inside the /opt/forticlientems/bin/ directory. A diagnostic report zip file can be created by running the following command inside the Linux shell. The output file will have a .zip extension (/tmp/diag.zip in the following command).

sudo /opt/forticlientems/bin/diagnostic_tool -o /tmp/diag

Once the logs are collected, download them from the /tmp/ directory to the local system for analysis.

To download the logs:

1. Using SCP (Secure Copy Protocol) to download the files from the EMS server to the local machine. 

• Open a new terminal on the local machine.
• Replace the username, EMS_IP, and the paths as necessary.

scp username@EMS_IP:/tmp/fortiems_logs.tar.gz ~/Desktop/

scp username@EMS_IP:/tmp/apache_logs.tar.gz ~/Desktop/
scp username@EMS_IP:/tmp/postgresql_logs.tar.gz ~/Desktop/
scp username@EMS_IP:/tmp/redis_logs.tar.gz ~/Desktop/
scp username@EMS_IP:/tmp/ufw_logs.txt ~/Desktop/
scp username@EMS_IP:/tmp/system_logs.txt ~/Desktop/

scp username@EMS_IP:/tmp/diag.zip ~/Desktop/

Each file will be saved to the desktop (or the directory specified) for further review or sharing with the support team.

2. Using the FortiClient EMS CLI tool.

./emscli execute diagnostic --copy.service scp --remote.ip --remote.user --remote.password --remote.folder

Related document:

How to use emscli CLI tool to manage FortiClient