Staff

Troubleshooting Tip: Reduce size of FortiManager/FortiAnalyzer TAC report

Forum|Forum|1 year ago
March 31, 2025
0 replies
604 views

Description

This article describes how to handle issues where the FortiManager or FortiAnalyzer crash log and/or kernel log contains a large number of entries and where the size of the TAC report may become huge (several GB). In contrast, the normal size is just a few MB.

Scope

FortiManager/FortiAnalyzer v7.x.

Solution

To reduce the TAC report size:

Dump the current crash log via CLI:

diagnose debug crashlog read

Save the crash log output to a text file (for future reference if needed).
Dump the current kernel log via CLI:

diagnose debug klog read

Save the kernel log output to a text file (for future reference if needed).
Clear the kernel log file via CLI:

diag debug klog clear

Clear the crash log via CLI:

diagnose debug crashlog clear

Create a TAC report with standard size:

execute tac report

A TAC report of 'normal' size significantly reduces the upload time to the support ticket and ensures better usability for the Fortinet engineer during analysis.

Related articles:

Technical Tip: Required information for TAC tickets

Technical Tip: How to create a log file of a session using PuTTY