Technical Tip: Explaining FortiGate update related log IDs

Whenever an update succeeds or fails in FortiGate, it generates certain system event logs. It can be filtered by the Message, Log Description, or Log IDs as follows:

1. If the FortiGate update succeeds: 
   • Log Description: 'FortiGate update succeeded'.
   • Log ID: '0100041000'.

date=2025-06-18 time=13:13:13 eventtime=1750232592215806964 tz="+0530" logid="0100041000" type="event" subtype="system" level="notice" vd="root" logdesc="FortiGate update succeeded" status="update" msg="Fortigate scheduled update fcni=yes fdni=yes fsci=yes from 173.243.141.6:443"

2. If the FortiGate update fails:
   • Log Description: 'FortiGate update failed'.
   • Log ID: '0100041001'.

date=2025-06-18 time=13:16:43 eventtime=1750232803487756713 tz="+0530" logid="0100041001" type="event" subtype="system" level="critical" vd="root" logdesc="FortiGate update failed" status="update" msg="Fortigate update now failed"

If the scheduled update causes temporary interruption or outage, it can be disabled under System -> FortiGuard -> FortiGuard Update by toggling the 'Scheduled update' option. 

To disable the FortiGuard update from the CLI, run the following:

config system autoupdate schedule
    set status disable
end