Troubleshooting Tip: FortiGate losing logs or events after reboot

Logs and events can be stored directly on FortiGate in one of two places:

1. In system memory.
2. On the disk.

These can be configured in the GUI under Log & Report -> Log Settings: 

• If only memory logging is enabled, FortiGate will store the logs and events in the system memory. These logs will be lost every time the FortiGate is rebooted or power cycled. 
• The second option of disk logging, if it is available and feasible, should be used to ensure that logs and events are not lost with a reboot or power cycle.

When using FortiGate devices where disk logging cannot be enabled, it is recommended to use FortiAnalyzer or configure a syslog server to store real-time logs and events. 

The command below is a key diagnostic command for investigating FortiGate instability, including scenarios where firewall logs are missing. It reveals process crashes, watchdog resets, or forced reboots, helping correlate system failures with interruptions in logging or network services.

Run the following in the FortiGate CLI:

diagnose debug crashlog read 

Related articles:

• Technical Tip: FortiOS Crashlog Filter 
• Technical Tip: The syslogd daemon often crashes causing FortiGate not to send logs to Syslog server properly 
• Technical Tip: How to check when the crash log is full