| The miglogd daemon is the logging process. This encompasses all logging to the FortiGate itself. In this scenario, one of the miglogd processes is running at 99% while the other miglogd processes are not. By design, the log messages are already load-balanced to all workers. But certain types of log items will always go to the first log queue and, with this, to a single miglogd worker. For example: - Event logs are always sent to the first miglogd worker.
- Logs with the same session_id end up in the same log queue and the same miglogd worker.
- GTP logs are sent to the same miglogd worker.
With the command 'diagnose log kernel-stats', it is possible to see the distribution of the logs to the individual queues. If one of them is much higher than the rest, it points towards it being expected behavior due to logs not always being spread across all processes due to the type of the log. diagnose log kernel-stats fgtlog: 15
fgtlog 0: total-log=1681839375222, failed-log=622363624679 log-in-queue=6
fgtlog 1: total-log=26194025556, failed-log=7769582 log-in-queue=0
fgtlog 2: total-log=26195403107, failed-log=7824155 log-in-queue=0
fgtlog 3: total-log=26157637187, failed-log=7809746 log-in-queue=0
fgtlog 4: total-log=26160313648, failed-log=7824947 log-in-queue=0
fgtlog 5: total-log=26217688514, failed-log=7583664 log-in-queue=0
fgtlog 6: total-log=26233427112, failed-log=7796637 log-in-queue=0
fgtlog 7: total-log=26221898289, failed-log=7595563 log-in-queue=0
fgtlog 8: total-log=26162786116, failed-log=7660160 log-in-queue=0
fgtlog 9: total-log=26159998194, failed-log=7826556 log-in-queue=0
fgtlog 10: total-log=26181704588, failed-log=7863642 log-in-queue=0
fgtlog 11: total-log=26184296614, failed-log=7831894 log-in-queue=0
fgtlog 12: total-log=26163714309, failed-log=7785276 log-in-queue=0
fgtlog 13: total-log=26192047359, failed-log=7831195 log-in-queue=0
fgtlog 14: total-log=26182595691, failed-log=7784297 log-in-queue=0 With the command 'diagnose test app miglogd 31 <daemon index> 1', the types of logs can be shown.
diagnose test app miglogd 31 1 1
2026-01-30 04:37:44 logid: 11 count: 7
2026-01-30 04:37:44 logid: 13 count: 5799 <-- logid 13 points to forward traffic policy logs, generated on session closure.
2026-01-30 04:37:44 logid: 15 count: 43
2026-01-30 04:37:44 logid: 20 count: 1437 <-- logid 20 points to forward traffic statistics
In the above example, the most busy log types are: - 13 - LOG_ID_TRAFFIC_END_FORWARD.
- 20 - LOG_ID_TRAFFIC_STAT.
Log IDs can be reviewed in the public documentation: Traffic. When encountering these issues, collect the additional information with the commands below and raise a ticket with the TAC support. diagnose debug reset
diagnose debug console timestamp enable
diagnose debug application miglogd -1
execute time
diagnose debug enable - Disable debugging after 2–5 minutes:
execute time
diagnose debug reset
diagnose debug disable
get sys stat
get sys perf stat
diagnose sys top 1 99 3 <--- Find the PID of the busy miglogd process.
miglogd 347 R 99.9 0.3 <--- For example 347.
fnsysctl ps <--- Confirm the busy process is 'miglogd 1', otherwise adjust the '1' in the commands below, for example: 347 0 0 R /bin/miglogd 1. diagnose log kernel-stats
diagnose test app miglogd 6
diagnose test app miglogd 26 1 <-- Adjust the 1 if any other miglogd process is busy. Command will enable process dump.
execute time - Wait for 30 seconds & execute the commands below:
execute time
diagnose test app miglogd 31 1
diagnose test app miglogd 31 1 1
diagnose test app miglogd 26 1 <-- '1' can be different depending on previous command. Command will disable process dump. | 
