Technical Tip: Miglogd Daemon: logging engine and its dependencies

Description

This article describes Miglogd, the core FortiGate log-building and publishing daemon. It receives raw log entries from various subscriber daemons (traffic, event, application-control, IDS/IPS, etc.), formats them, applies filter rules, and forwards the final log messages to the local log subsystem (locallogd) and/or remote log collectors such as fgtlogd, FortiAnalyzer, FortiCloud, and Syslog servers.

Scope

FortiGate (hardware & virtual) running any supported firmware version (e.g. v7.x, v8.0).

Solution

The daemon runs as a master process (ID 0) with one or more child processes that handle parallel log streams. It also provides a publisher/subscriber framework that other daemons can hook into, allowing modular expansion (e.g., reportd for log reports, samlogd for security‑event analytics, etc.).

Section 1:  Master/Child architecture.

Miglogd runs as a master (ID 0) that spawns N child daemons to parallel‑process logs.

diagnose test application miglogd 15  –shows master ID, number of children, and each child’s uptime.
diagnose test application miglogd 13  –add one child.
diagnose test application miglogd 14  –remove one child

Section 2: Log publishing.

Formats logs and publishes them to local (locallogd) and remote (fgtlogd) daemons

diagnose test application miglogd 6  –shows memory/disk usage, per‑type counters (sys, alert, alarm, faz, webt, etc.).

Section 3: Remote log server status.

Shows the status of connections to FortiAnalyzer, FortiCloud, or Syslog servers.

diagnose test application miglogd 20  –prints remote server IP, port, connection state, quota/usage

Section 4: Debugging.

Enables detailed debug output for the log‑filter engine, filter strings, and file‑search behaviour.

diagnose debug application miglogd <level>  –set level (e.g., 0x1000 for filter‑string debug).
diagnose debug enable – start logging.

Section 5: Log dumping/backup.

Temporarily pause miglogd to back up log files or dump raw log data safely.

diagnose sys process daemon-auto-restart disable miglogd -Stop
diagnose sys process daemon-auto-restart enable miglogd  -Start
diagnose test application miglogd 26 1 -Dump enable
diagnose test application miglogd 33   -List dump files
diagnose test application miglogd 34   -Copy to USB: 

Section 6: Performance tuning.

Adjust the number of child processes based on log volume.

Use the add/remove child commands above; monitor interface‑missed (queues overflow) to decide if more children are needed.

Troubleshooting flow:

• Verify daemon health.
  
  

diagnose test application miglogd 15  -If children = 0, restart the service:
diagnose sys process daemon-auto-restart enable miglogd

• Check remote connections:
  
  

diagnose test application miglogd 20  -Look for “state=connected”. If disconnected, verify DNS, firewall rules, and certificates on the remote FAZ/FACS.

• Inspect the log queue overflow:
  
  

diagnose test application miglogd 6  -High interface‑missed indicates the queue is full; consider adding a child (diagnose test application miglogd 13).

• Enable filter‑debug:
  
  

 diagnose debug application miglogd 0x1000  -Re‑run the event that is missing; the debug output will show which filter string is applied and which log files are searched.

• Collect a dump for Fortinet Support:
  
  

diagnose test application miglogd 26 1  -Let the device run a few minutes, then copy dump files 
diagnose test application miglogd 34