Skip to main content
marcog86
marcog86
New Member
January 3, 2022
Question

Events and Issues on Fortigate Firewall

  • January 3, 2022
  • 1 reply
  • 2597 views

Hi Guys

Happy new year.

This morning I found fortigate blocked (fortigate 300E), it's in HA mode Active Active. Firewall was reachable but all the traffic was locked because ( i think)  there was an overlaod of memory 88% (i think RAM memory). The faster solution was been to restart device via cli.

Now the backup fortigate is running as master and memory is running on 46%

 

I looking for any issue or any details about this block via web interface but I didn't find anything. I don't know if it's necessary to implement any config.

I noted an issue:

I configured syslog server via cli and I enabled only warning severity and lower 1 mounth ago.

On Syslog server I don't find any log over 29/12/21 at 14:47 o'clock.

After reboot syslog server restart to receive logs from Fortigate, from logs I don't find anything.

 

On fortigate I disabled save of logs on local memory, is it correct?

 

Where I can looking for the issue? Is there any cli command to looking for the issue?

I know it's general request but I don't know how I can start.

 

Marco

 

1 reply

AlexC-FTNT
Staff
AlexC-FTNT
Staff
January 3, 2022

There are 3 places to look:

- system event logs

- crashlog (may be cleared at reboot or if memory logging disabled) 

https://community.fortinet.com/t5/FortiGate/Technical-Note-How-to-clear-the-crash-log/ta-p/198082?externalId=FD40302&sliceId=1

- comlog (if it was enabled)
https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-use-COMLog-feature/ta-p/195390?externalID=FD35193

 

If you can't find it in these places, you won't be able to find out. 

Terms & ConditionsAccessibility statement