Technical Tip: Troubleshooting ICAP Adapter When File Submission Stops on FortiSandbox

Description

This article describes how to collect diagnostic information when the ICAP adapter stops receiving or processing file submissions on FortiSandbox.

In some situations, file submission through the ICAP adapter may stop unexpectedly. The ICAP service may also generate system log messages indicating that the service has automatically restarted.

Examples include:

• FSA-ICAP: restart due to lack of request

• FSA-ICAP: Restart triggered by service outage

In some cases, the following message may subsequently be observed:

• FSA-ICAP: Listening on port1:0 <IP_address>:1344 <PID>

The Listening message indicates that the ICAP service is listening on TCP port 1344. However, the presence of this message alone does not confirm that ICAP requests are successfully reaching the adapter or that the adapter is processing requests correctly.

If file submission through ICAP stops, collect diagnostic information while the issue is occurring before restarting or disabling and re-enabling the ICAP adapter.

Scope

FortiSandbox with the ICAP adapter enabled.

Solution

When the issue occurs, collect the following diagnostic information from the FortiSandbox CLI:

1. Collect ICAP adapter debug output:
   
   

diagnose-debug adapter_icap

Collect the output while an ICAP file submission attempt is taking place.

This output can help determine the status of the ICAP adapter and whether requests are being received and processed.

2. Capture ICAP traffic on TCP port 1344:

tcpdump -ni port1 port 1344

This captures traffic associated with the ICAP service on TCP port 1344.

Verify whether:

• ICAP connection attempts are reaching the FortiSandbox.

• TCP connections to port 1344 are established successfully.

• ICAP requests are being sent to the FortiSandbox.

• The FortiSandbox is responding to the ICAP requests.
  
  

3. Reproduce the issue or wait for an ICAP submission attempt:
   

Keep both debug commands running and attempt to submit a file through ICAP.

Collect the output before performing any recovery action.

4. Avoid restarting the ICAP adapter before collecting the output:

Do not immediately disable and re-enable the ICAP adapter when the issue occurs.

Restarting or re-enabling the adapter may restore file submission and remove the active condition required for further investigation.

Collect the following information first:

diagnose-debug adapter_icap

tcpdump -ni port1 port 1344

The collected information can then be provided to TAC for further analysis.

Note:

System logs may show automatic ICAP service restart events, such as:

• FSA-ICAP: restart due to lack of request.

or:

• FSA-ICAP: Restart triggered by service outage.
  
  

These messages indicate that an ICAP service restart was triggered.
Further diagnostics are required to determine whether the ICAP adapter is receiving requests and responding correctly after the restart.