Technical Tip: How to display interface traffic history in FortiGate CLI
Description
This article describes how to display traffic history data for three different time periods in FortiGate CLI which might be useful when troubleshooting FortiGate GUI Interface Bandwidth widget issue or when validating bandwidth utilization spikes/drops in last one hour while an external monitoring system is unable to detect the same due to insufficient SNMP polling interval.
Scope
FortiGate CLI.
Solution
Before displaying traffic history data, it is necessary to enable monitoring for a specific interface by using the following CLI command:
config system interface
edit <Interface name>
set monitor-bandwidth enable
next
end
Use the following CLI command to display a list of monitored interfaces:
diagnose debug traffic interface
An example of output with the list of monitored interfaces is shown below:
diagnose debug traffic interface
Interfaces:
port19
port20
LAG01
3 monitored interfaces.
Note: The 'monitor-bandwidth' settings for a specific interface are automatically enabled when creating a new Interface Bandwidth widget in FortiGate GUI dashboard.
In FortiOS v7.4.3 and older releases, it is necessary to use 'diagnose debug enable' to enable output visibility via SSH or GUI console. This is not required when using FortiGate Console port access or in FortiOS v7.4.4 and later releases.
Once interface monitoring is enabled, FortiGate will start collecting statistics for specific interfaces every 10 seconds for one hour period and then aggregate data for 24 hours period and one week period.
Use the following CLI command to display interface history data (Period: hour=0, day=1, week=2):
diagnose debug traffic history <Interface name> <Period>
Note: The first column of the output shows a ring buffer ID, and the next two columns show the outbound traffic rate (Tx bit rate) and inbound traffic rate (Rx bit rate).
An example of interface history data output with one hour period:
diagnose debug traffic history LAG01 0
sample_time=1778616474 update_time=4409475490
last_rx=1062790275458 last_tx=573826426
next_tx= 24576, next_rx= 24576)
---------------------------------------------
290 - ( 3920, 4728)
291 - ( 4088, 4216)
292 - ( 4096, 4432)
293 - ( 4008, 4816)
294 - ( 4096, 4136)
295 - ( 4096, 4728)
296 - ( 4008, 4224)
297 - ( 3832, 3744)
298 - ( 4000, 4728)
299 - ( 3920, 4224)
000 - ( 4096, 4728)
001 - ( 4008, 4176)
002 - ( 4096, 4136)
003 - ( 4000, 4728)
004 - ( 3920, 4224)
005 - ( 4096, 5072)
006 - ( 4008, 4096)
007 - ( 3840, 3880)
008 - ( 4096, 4728)
...
An example of interface history data output with a 24 hour period:
diagnose debug traffic history LAG01 1
sample_time=1778616296 update_time=4409457690
last_rx=1062790182246 last_tx=573741562
next_tx= 57344, next_rx= 62976)
---------------------------------------------
267 - ( 4000, 4400)
268 - ( 3992, 4384)
269 - ( 4008, 4392)
270 - ( 4016, 4392)
271 - ( 3992, 4392)
272 - ( 3992, 4408)
273 - ( 4024, 4384)
274 - ( 3992, 4408)
275 - ( 3992, 4360)
276 - ( 3992, 4416)
277 - ( 3992, 279550208)
278 - ( 4008, 615300608)
279 - ( 4016, 922876800)
280 - ( 4024, 560292928)
281 - ( 4000, 4408)
282 - ( 3992, 4400)
283 - ( 3992, 4384)
284 - ( 3992, 4400)
285 - ( 4008, 4376)
286 - ( 4016, 4392)
287 - ( 4008, 4408)
288 - ( 3992, 4368)
289 - ( 4032, 4400)
290 - ( 4008, 4392)
291 - ( 3984, 4392)
292 - ( 3992, 258710496)
293 - ( 3992, 2119755264)
294 - ( 4000, 2116157696)
295 - ( 3992, 2119808128)
296 - ( 4000, 2115542272)
297 - ( 4088, 2115986688)
298 - ( 4024, 2065554944)
299 - ( 3992, 2116292224)
000 - ( 4016, 2120183808)
001 - ( 3992, 2115982592)
002 - ( 4008, 2115902592)
003 - ( 4048, 2120593024)
004 - ( 4032, 2116355200)
005 - ( 4008, 1504728832)
006 - ( 4008, 4416)
007 - ( 3992, 4400)
008 - ( 4008, 4384)
009 - ( 4008, 4408)
Use the following CLI command if it is necessary to clear old traffic history counters (available from FortiOS v7.4):
diagnose debug traffic clear <Interface name>
Related articles: