FortiGate restarted - how to find the logs

If you are doing only "memory" logging, it's gone when it rebooted. If it's a model with HDD/SSD and you are doing "disk" logging, everything should be still there unless it ran over the capacity. If you are sending log to a "syslog" server or FortiAnalizer outside of the unit, of course it's there.

At least one thing you should check if all logs are gone is "crashlog" with "diag debug crashlog read". There might be a crash dump in it.

Toshi  

Hi,

You can enable comlog if the device supports.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-use-the-COMLog-feature/ta-p/195390

You can also connect to console of the device and when there is a reboot it will collect kernel related logs.

https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-How-to-deal-with-a-kernel-panic/ta-p/226804