Technical Tip: Retrieve log from the HA 'Secondary' unit in FortiWeb

This article describes that In the FortiWeb HA cluster, if there is no dedicated reserve management IP (ha-mgmt-interface), both 'Primary' and 'Secondary' units will share the same interface IP addresses.

So only the HA 'Primary' unit can be accessed by GUI or CLI.

If the log in the HA 'Secondary' unit needs to be retrieved, the procedure below can be used.

Enable file upload.

config system setting

   set enable-file-upload enable

 end

Log in to the HA 'Primary' unit and execute the command below to export the log to the HA 'Secondary' unit.

FWB_master # diagnose system ha export-eventlog

<id>    please input peer box index.

<1>   Subsidary unit FVVM020000100001

<2>   Subsidary unit FVVM020000100002

FWB_master # diagnose system ha export-eventlog 1 24/04/2022:00:00:00 25/04/2022:23:59:00

log file export-eventlog-1.tgz has been get.

Download it from System -> Maintenance -> Backup&Restore from GUI.

Download the event log file in GUI of the HA 'Primary' unit. Go to System-> Maintenance -> Backup&Restore, and select 'Download'.

The log file of the HA 'Secondary' unit is now available for review.

For example:

v010xxxxdate=2022-04-25 time=11:25:34 log_id=10000023 msg_id=000000005220 device_id= FVVM020000-----2 vd="root" timezone="(GMT+8:00)Kuala Lumpur,Singapore" timezone_dayst="GMTc-8" type=event subtype="system" pri=information trigger_policy="N/A" user=system ui=system action=start status=success msg="Backup daemon started"

Related document:

CLI Reference - system ha export-eventlog