Technical Tip: Logs not displayed because of corrupted log hard disk
Description
This article describes that sometimes logs are not displayed on the FortiGate unit because of a corruption in the log hard disk. There are a number of reasons that the log hard disk could be corrupted, including wrong upgrades/downgrades or power failures.
Scope
FortiOS.
Solution
A quick check of the FortiGate unit can be made using 'get system status' and this will show the status of the log hard disk.
get system status
Version: FortiGate-VM64-KVM v7.2.11,build1740,250210 (GA.M)
Security Level: High
Firmware Signature: certified
Virus-DB: 93.06571(2026-02-03 08:46)
Extended DB: 93.06571(2026-02-03 08:45)
Extreme DB: 1.00000(2018-04-09 18:07)
AV AI/ML Model: 4.03686(2026-02-03 08:41)
IPS-DB: 6.00741(2015-12-01 02:30)
IPS-ETDB: 35.00162(2026-02-03 03:29)
APP-DB: 35.00162(2026-02-03 03:28)
FMWP-DB: 26.00011(2026-01-21 14:32)
INDUSTRIAL-DB: 35.00162(2026-02-03 03:28)
IPS Malicious URL Database: 5.00620(2026-01-16 02:01)
IoT-Detect: 35.00162(2026-02-02 14:41)
Serial-Number: FGVM01TM23000525
License Status: Valid
VM Resources: 1 CPU/1 allowed, 1992 MB RAM
Log hard disk: Need Format
Hostname: Challenger-kvm100
Private Encryption: Disable
Operation Mode: NAT
Current virtual domain: root
Max number of virtual domains: 10
Virtual domains status: 1 in NAT mode, 0 in TP mode
Virtual domain configuration: disable
FIPS-CC mode: disable
Current HA mode: standalone
Branch point: 1740
Release Version Information: GA
FortiOS x86-64: Yes
System time: Tue Feb 3 13:39:48 2026
Last reboot reason: warm reboot
Version: FortiGate-VM64-KVM v7.2.11,build1740,250210 (GA.M)
Security Level: High
Firmware Signature: certified
Virus-DB: 93.06571(2026-02-03 08:46)
Extended DB: 93.06571(2026-02-03 08:45)
Extreme DB: 1.00000(2018-04-09 18:07)
AV AI/ML Model: 4.03686(2026-02-03 08:41)
IPS-DB: 6.00741(2015-12-01 02:30)
IPS-ETDB: 35.00162(2026-02-03 03:29)
APP-DB: 35.00162(2026-02-03 03:28)
FMWP-DB: 26.00011(2026-01-21 14:32)
INDUSTRIAL-DB: 35.00162(2026-02-03 03:28)
IPS Malicious URL Database: 5.00620(2026-01-16 02:01)
IoT-Detect: 35.00162(2026-02-02 14:41)
Serial-Number: FGVM01TM23000525
License Status: Valid
VM Resources: 1 CPU/1 allowed, 1992 MB RAM
Log hard disk: Need Format
Hostname: Challenger-kvm100
Private Encryption: Disable
Operation Mode: NAT
Current virtual domain: root
Max number of virtual domains: 10
Virtual domains status: 1 in NAT mode, 0 in TP mode
Virtual domain configuration: disable
FIPS-CC mode: disable
Current HA mode: standalone
Branch point: 1740
Release Version Information: GA
FortiOS x86-64: Yes
System time: Tue Feb 3 13:39:48 2026
Last reboot reason: warm reboot
The only solution to this problem is to perform an 'execute formatlogdisk'.
execute formatlogdisk
Care should be taken in using this command, as it formats the storage, erasing all data on it, including logs, quarantine files, and WanOpt caches, and requires the unit to reboot.
If flash remains inaccessible after formatting, Fortinet TAC can confirm hardware failure and process an RMA replacement. The defective unit may need advanced or priority replacement depending on the support agreement.
Avoid Future Issues: Store logs externally (FortiAnalyzer or FortiCloud) to reduce flash wear and maintain longer retention.
Related article: