Skip to main content
haljawhari
Staff
haljawhari
Staff
December 4, 2009

Technical Tip: Standard procedure to format a FortiGate Log Disk, log backup from disk

  • December 4, 2009
  • 0 replies
  • 58462 views

Description

 

This article describes the standard procedure to format a FortiGate Hard Disk, which is used for logging purposes.
If the procedure fails, refer to this article: Technical Tip: Advanced procedure to format a FortiGate hard disk

Scope

 

FortiGate (all versions). Except for firewalls without hard drives.

 

Solution

 

Notes:

  • If necessary, consider performing a backup of logs before formatting (see details below).

  • In an HA environment, the command will be applied only to the unit on which the command was run. That unit alone will reboot.
    The action will not be synchronized with the other units in the cluster.

 

The following command will start the disk formatting upon selecting 'y':

 

execute formatlogdisk 


Log disk is /dev/sda1.
Formatting this storage will erase all data on it, including
logs, quarantine files;
certificate revocation lists (CRLs);
and require the unit to reboot.
Do you want to continue? (y/n)

 

Log backup options (before formatting):

 

In FortiOS v7.0+:

 

First, select which logs to back up (from disk):

 

execute log filter device 1

 

(0 = memory, 1 = disk, 2 = FortiAnalyzer, 3 = FortiAnalyzer Cloud, 4 = FortiCloud).

 

execute log backup ftp <file name > <ip or fqdn>[:ftp port]<username> <password>


execute log backup local <file path>


execute log backup tftp <file name > <ip or fqdn>

 

In FortiOS v6.4:

execute log disk local <file path>
execute log disk ftp <file name > <ip:port> <username> <password>
execute log disk tftp <file name > <ip>


FortiOS v5.0 to v6.2 adds support for performing a backup to an external disk connected to the FortiGate USB port:

 

execute log backup <file path>

 

In v4.0, before formatting the disk, the existing log file(s) can be backed up by running either one of the following two commands:

 

execute backup disk alllogs ftp [or tftp] <ip>


execute backup disk log ftp [or tftp] <ip> <log_type>

 
To display all log file types in v4.0MR1, enter a ? at the end of the command.

For example:

 

execute backup disk log tftp 192.168.1.1 traffic

 
Note: The firewall or antivirus software on the workstation or server may be blocking TFTP traffic. In such cases, temporarily disabling the firewall or antivirus software during the file transfer is recommended.

Related articles:

      Terms & ConditionsAccessibility statement