Skip to main content
pprince
Staff
pprince
Staff
April 30, 2025

Technical Tip : How to check and troubleshoot incorrect information sent to syslog server by FortiExtender

  • April 30, 2025
  • 0 replies
  • 332 views
Description

 This article describes how to check and troubleshoot incorrect information sent to the syslog server by FortiExtender.

 

For example: 

FortiExtender is sending the correct hostname to the syslog server (Sending Serial number instead of the hostname).

 

Refer to the below configuration on FortiExtender :

 

"global": {
"hostname": "TAC",  --------------->Configured hostname
"timezone": 26,
"auto-install-image": "disable",
"default-image-file": "",
"mdm-fw-server": "fortiextender-firmware.forticloud.com",
"os-fw-server": "fortiextender-firmware.forticloud.com"

Syslog config:

    "syslog": {
            "remote-servers": {
                "1": {
                    "ip": "172.2X.6X.2X",    -----------------> Syslog server
                    "port": 1514
                }
            },
            "statistic-report": {
                "status": "enable",
                "interval": 30,
                "cpu-usage": {
                    "threshold": 70,
                    "variance": 5
                },
                "memory-usage": {
                    "threshold": 50,
                    "variance": 5
                },
                "cpu-temperature": {
                    "threshold": 80,
                    "variance": 5
Scope FortiExtender.
Solution
  1. Upgrade the FortiExtender to the latest available version to start troubleshooting the issue.
  2. Check if all the required processes are running on the FortiExtender.

 

get system app-status

name type command pid state
SYSLOGD APP_T_MONIPID syslogd 1126 RUNNING
CONFIG APP_T_INFRA json_config 1133 RUNNING
ZEBRA APP_T_MONIPID zebra 1135 RUNNING

 

  1. Perform a reboot/SSH/console/HTTPS/HTTP connection on the FortiExtender to check if the issue persists in all the scenarios.


For example:

FortiExtender is sending the following details :


<150>Mar 10 14:56:16 event: timestamp="1741618576" hostname="TAC" type="event" subtype="config" action="CLI configuration update" logdesc="FortiExtender configuration changed by JCLI (appid#10)" msg="/system/global/hostname changed from () to TAC " 10.37.165.197 10/03 20:26:18.140
<150>Mar 10 14:56:37 event: timestamp="1741618597" hostname="TAC" type="event" subtype="system" action="system status" logdesc="system status" msg="Memory usage rate warning: current Memory usage rate:19" 10.37.165.197 10/03 20:26:39.099
<150>Mar 10 14:56:37 event: timestamp="1741618597" hostname="TAC" type="event" subtype="system" action="system status" logdesc="system status" msg="Memory usage rank: Summary: slab:16724 buf:11520 cache:40020 dirty:0 write:0
 top1: 11924 extenderd, top 10.37.165.197 10/03 20:26:39.251
<150>Mar 10 14:56:37 event: timestamp="1741618597" hostname="TAC" type="event" subtype="system" action="system status" logdesc="system status" msg="CPU temperature warning: current CPU temperature:43.2" 10.37.165.197 10/03 20:26:39.300
<142>Mar 10 14:56:37 statistic: timestamp="1741618597" hostname="TAC" type="statistic" subtype="config" action="system statistic" logdesc="system statistic" msg="Performance statistics: current CPU:0.0, memory:19, CPU temperature: 43.2 degree Celsius" 10.37.165.197 10/03 20:26:39.363

After reboot, the hostname shows as the serial number instead of 'TAC':

<150>Jan 1 00:00:46 event: timestamp="46" hostname="FXE11FS222xxxxxx" type="event" subtype="config" action="APP configuration update" logdesc="FortiExtender configuration changed by NETD (appid#6)" msg="/router/target/target.port4/next-hop changed from ( 10.37.165.197 10/03 20:28:38.242
<150>Jan 1 00:00:56 event: timestamp="56" hostname="FXE11FS222024633" type="event" subtype="system" action="system status" logdesc="system status" msg="Memory usage rate warning: current Memory usage rate:17" 10.37.165.197 10/03 20:28:48.405
<150>Jan 1 00:00:56 event: timestamp="56" hostname="FXE11FS222xxxxxx" type="event" subtype="system" action="system status" logdesc="system status" msg="Memory usage rank: Summary: slab:16560 buf:11180 cache:38836 dirty:0 write:0
 top1: 11844 extenderd, t 10.37.165.197 10/03 20:28:48.466
<150>Jan 1 00:00:56 event: timestamp="56" hostname="FXE11FS222xxxxxx" type="event" subtype="system" action="system status" logdesc="system status" msg="CPU temperature warning: current CPU temperature:45.9" 10.37.165.197 10/03 20:28:48.519

 

  1. Collect packet capture on the FortiExtender interface of the FortiGate to check if FortiExtender is sending out the correct hostname.

 

hostname 1.png

 

 

  1. Kill the syslogd process on the FortiExtender :

 

execute restartapp SNMPD <pid>

 

Example:

 

execute restartapp SNMPD 1126

 

Related document: 

Configure the system syslog
Terms & ConditionsAccessibility statement