Staff

Troubleshooting Tip: Device(s) stopped sending logs to SOCaaS error on FortiCloud portal

Description

This article describes how to handle an issue where the device stopped sending logs.

Scope

FortiGate v6.x, v7.x.

Solution

The following error is seen on the FortiCloud portal:

Logging Error 2.png

Check if the license is there for SOC As A Service.
If in High Availability, check if the license is there for both units in HA.
Check if any crashes in the crashlog (diagnose debug crashlog read) or conserve mode or HA failover are associated with it.
SOCaaS relies on FortiAnalyzer for log forwarding rather than receiving logs directly from FortiGate. Make sure connectivity between FortiGate and FortiAnalyzer is stable, as well as logs are sent from FortiGate to FortiAnalyzer.
Check if there is any matching log in memory or FortiAnalyzer Cloud if using. It may show something like: Log Description: 'FortiAnalyzer ... logs may show that from <date> <time> the connection to FortiAnalyzer Cloud was down. It recovered spontaneously'. That may indicate a temporary network connection issue.

Related documents:

Sign up