Troubleshooting Tip: FortiWeb does not record traffic or attack logs

Assuming the log is enabled, follow the KB article below: Technical Tip: How to enable traffic logs for version 7.0 and later.

Problem Summary:

An issue was reported where  FortiWeb does not record any logs. 

Troubleshooting:

To further verify the issue, collect and attach the below-requested logs, and upload them to the ticket:

diagnose debug crashlogs show
get system status
fnsysctl ps
diagnose hardware logdisk info
diagnose system mount list
diagnose hardware harddisk list
diagnose debug application logd 7
diagnose debug enable

To disable the debug, execute the following command:

diagnose debug disable

Or follow this workaround:

Run the command 'diagnose system ps' and note down the process ID for the logd process.

Then run the command:

diagnose sys kill 9 <process id of logd>

If this step does not solve the issue, rebuild the Database. Run the below CLI command for database rebuild:

execute db rebuild

This operation will clean and rebuild the database for disklog.

Also, check if the traffic log is enabled in the policy:

config server-policy policy
    edit "policy name"
        set tlog enable
end

Related document:

Step-by-step troubleshooting for log display on FortiWeb GUI failures 

The proposed workaround involved rebuilding the log database to resolve the issue, possibly:

It is recommended to run this command during low-peak hours. This is because the process recreates the log database.

Note:

Users facing similar log delay issues should consider rebuilding the log database, but should be aware of the potential high disk IO usage during the process and thus choose off-peak hours for the operation.

If FortiWeb has an HA configuration in HA mode, running 'execute db rebuild' on the master appliance will take effect on all slaves simultaneously.