Troubleshooting Tip: Interpreting HTTPSD debug logs when troubleshooting FortiGate GUI access

Description

This article describes how HTTPSD debug traces the FortiGate processing of GUI requests, including login page delivery, administrator authentication, post-login API requests, and logout. Correlate timestamps, requested URIs, assigned handlers, authentication results, and HTTP response codes to identify stages where GUI processing is delayed or unsuccessful. Always interpret indicators collectively; do not diagnose GUI issues solely from isolated warnings or response codes.

Scope

FortiGate - HTTPS GUI access, login performance, post-login loading, session troubleshooting, log‑to‑packet‑capture correlation.

Solution

1. Validate the Standard GUI Processing Sequence:
   
   

Verify progression against the expected workflow:

HTTPS connection established -> /login processed ->/logincheck  submitted ->authentication completed ->API & CMDB requests processed ->GUI displayed.

If the sequence halts or shows an unusual timestamp gap, troubleshoot at that specific stage.

2. Analyze Key Workflow Stages Using Log Reference:

Login Page Request:

Browser issues a GET /login request:

2026-08-26 05:01:35 [httpsd 343 - 1787745695 info] fweb_debug_init[527] -- New GET request for "/login" from "172.21.33.7:52188"
2026-08-26 05:01:35 [httpsd 343 - 1787745695 info] fweb_debug_init[531] -- Handler "login-handler" assigned to request
2026-08-26 05:01:35 [httpsd 343 - 1787745695 info] fweb_debug_final[369] -- Completed GET request for "/login" (HTTP 200)

• HTTP 200 confirms login page processed successfully.
  
  

Authentication Request:
Credentials trigger POST /logincheck:

2026-08-26 05:01:44 [httpsd 343 - 1787745704 info] fweb_debug_init[527] -- New POST request for "/logincheck" from "172.21.33.7:52188"
2026-08-26 05:01:44 [httpsd 343 - 1787745704 info] fweb_debug_init[531] -- Handler "logincheck-handler" assigned to request
2026-08-26 05:01:44 [httpsd 343 - 1787745704 info] logincheck_handler[460] -- entering vdom for login_attempt (vdom='root')
2026-08-26 05:01:47 [httpsd 343 - 1787745707 info] logincheck_handler[563] -- login attempt OK, VDOM updated to 'root'
2026-08-26 05:01:47 [httpsd 343 - 1787745707 info] logincheck_handler[569] -- login_attempt (method=6, vdom='root', name='admin', admin_name='admin', auth_svr='')
2026-08-26 05:01:47 [httpsd 343 - 1787745707 info] fweb_debug_final[369] -- Completed POST request for "/logincheck" (HTTP 200)

Post-Login GUI Loading:

After authentication, API requests populate the interface:

2026-08-26 05:01:48 [httpsd 374 - 1787745708 info] fweb_debug_init[527] -- New GET request for "/api/v2/monitor/web-ui/node-auth" from "172.21.33.7:52188"
2026-08-26 05:01:48 [httpsd 374 - 1787745708 info] endpoint_process_req_vdom[1078] -- new API request (action='select', path='web-ui', name='node-auth', vdom='root', user='admin')
2026-08-26 05:01:48 [httpsd 374 - 1787745708 info] endpoint_process_req_vdom[1084] -- completed API request
2026-08-26 05:01:48 [httpsd 374 - 1787745708 info] fweb_debug_final[369] -- Completed GET request for "/api/v2/monitor/web-ui/node-auth" (HTTP 200)

Delays point to slow API or CMDB queries. Example CMDB activity:

api_cmdb_request_init_by_path[2826] -- new CMDB query (path='system', name='admin')
api_cmdb_request_init_by_path[2858] -- querying CMDB entry (mkey='admin')
api_cmdb_request_init_child[2913] -- new CMDB child query for 'system.admin.gui-dashboard':'admin'

Session Termination:

Logout sequence confirms session end:

2026-08-26 05:02:29 [httpsd 380 - 1787745749 info] fweb_debug_init[527] -- New GET request for "/logout" from "172.21.33.7:52188"
2026-08-26 05:02:29 [httpsd 380 - 1787745749 info] fweb_debug_init[531] -- Handler "logout-handler" assigned to request
2026-08-26 05:02:29 [httpsd 380 - 1787745749 info] fweb_debug_final[369] -- Completed GET request for "/logout" (HTTP 200)
2026-08-26 05:02:29 [httpsd 343 - 1787745749 info] fweb_debug_init[527] -- New GET request for "/login" from "172.21.33.7:52188"

3. Interpret Response Codes and Warnings Contextually:

• HTTP 401 on /api/v2/monitor/web-ui/extend-session immediately before logout = session expiry, not login failure. Review full request sequence.

  extractkey_param[97] -- REST API key in URL parameters is disabled = informational. Ignore if subsequent requests return HTTP 200.
  
  
  

4. Correlate Logs with Packet Captures:

Cross-reference HTTPSD logs with client‑to‑management captures:

172.21.33.7.49978 -> 10.5.27.216.443: syn
10.5.27.216.443 -> 172.21.33.7.49978: syn ack

• Successful TCP handshake confirms HTTPS connectivity. Delays within logs indicate local processing latency.
  
  

Note:

Correlate URI, timestamps, authentication status, handler activity, and HTTP response before concluding root cause. Isolated warnings or codes may indicate normal operation.