Technical Tip: Understanding the interface-missed counter when troubleshooting syslog on FortiGate
| Description | This article describes how to interpret the interface-missed counter when investigating syslog delivery behavior on FortiGate. During troubleshooting, the interface-missed value may increase while log messages continue to be successfully delivered to the syslog server. This behavior may lead to the incorrect assumption that log messages are being dropped by the firewall. The purpose of this article is to clarify what the interface-missed counter represents and how it should be interpreted when validating syslog delivery. |
| Scope | FortiGate. |
| Solution | When investigating suspected syslog delivery issues, it is important to verify the logging process on the FortiGate and correlate the interface-missed counter with additional logging statistics to determine whether log forwarding is functioning as expected.
Check the syslog configuration on the FortiGate to confirm that log forwarding is enabled and properly configured:
config log syslogd setting
Verify parameters such as the configured server and the transport mode.
Review syslog daemon statistics on the FortiGate:
diagnose test application syslogd 9
This command displays counters such as the number of packets sent and the number of bytes transmitted to the syslog server. An increase in these counters indicates that the FortiGate continues to forward logs to the external logging system.
Check logging subsystem statistics:
diagnose test application miglogd 6
The output includes the interface-missed counter. This counter represents log messages that could not be immediately processed by the logging interface queue.
An increase in the interface-missed value does not necessarily indicate that log messages are lost. The counter reflects conditions where the logging subsystem cannot immediately forward a log message through the interface queue. The counter is cumulative and should not be interpreted as a real-time indicator of log delivery status.
Additional validation can be performed by comparing logging counters over time. Run the following commands twice with an interval of approximately five to ten minutes:
diagnose test application miglogd 6
Review the sentpkt value in the syslog daemon statistics. If the sentpkt counter increases proportionally to the expected log generation rate, the FortiGate continues to forward log messages to the syslog server.
Compare the increase in the sentpkt counter with the number of log entries ingested by the syslog server during the same time window. When the growth of the syslog server log count aligns with the delta observed in the FortiGate counters, log delivery integrity is confirmed even if the interface-missed counter continues to increase.
This correlation demonstrates that the interface-missed value reflects temporary logging queue behavior rather than permanent log loss. |
