Skip to main content
ZafirFX
ZafirFX
New Member
March 3, 2022
Question

Fortigate to Analyzer

  • March 3, 2022
  • 1 reply
  • 3988 views

Hi community,

 

I have few Fortigates logging directly and real time to FortiAnalyzer.  All of them doing fine except one HA setup. I added the device in to the FAZ and while it's connected and registered it just not sending any logs. From the FGT I can ping and telnet the FAZ on port 514. The device is also registered :

 

Registration: registered
Connection: allow
Adom Disk Space (Used/Allocated): 43299899634B/53687091200B
Analytics Usage (Used/Allocated): 33557392016B/37580963840B
Analytics Usage (Data Policy Days Actual/Configured): 1/60 Days
Archive Usage (Used/Allocated): 9742507618B/16106127360B
Archive Usage (Data Policy Days Actual/Configured): 6/180 Days
Log: Tx & Rx (log not received)
IPS Packet Log: Tx & Rx
Content Archive: Tx & Rx
Quarantine: Tx & Rx

 

I did some debugging and see the following on FAZ:

 

diagnose test application oftpd 50

2022-03-01 12:11:30 FGXXXXX  root 0 retrieve from cache failed: key not found
2022-03-01 12:11:30 FG2XXXX  root 0 retrieve from cache failed: key not found

 

This is from the device that just won't send any log.

Any idea whats going on here?

1 reply

AlexC-FTNT
Staff
AlexC-FTNT
Staff
March 4, 2022

Quick question: did you reboot the FortiGate? Did you reboot the FAZ? 
A reboot may generally solve a lot of problems or confirm certain aspects.

 

Without reboot, try to restart the oftpd on FortiGate:

>  Step:1 -First run this command and identify the OFTPD Process ID (PID)
# diag system process list

or, if newer:

# diag sys process pidof oftpd

> Step:2 -Then kill the OFTPD process running using the command:
# diagnose system process kill 11 <pid> <<--- PID is the process ID listed above

Debbie_FTNT
Staff & Editor
Debbie_FTNT
Staff & Editor
March 4, 2022

I think you mean miglogd :)

-> On FortiGate side, it is the miglogd process sending logs to FAZ

@ZafirFX the steps would restart the miglogd daemon, which can help a lot with logging issues

-> oftpd is the process on FAZ receiving the logs

 

If the issue remains after restarting miglogd, you can check the following:
- does the HA setup have ha-direct enabled?

#show system ha

-> if yes, that means each FortiGate unit is trying to send the logs via HA management interface instead of whatever other route it should take based on routing table

- packet capture on the FortiGate to confirm it is actually trying to send on port 514 (and out the correct interface)

- diag sniffer on FortiAnalyzer to confirm the traffic is actually arriving

- miglogd debug on FortiGate
#dia de app miglogd -1

#dia de en

- oftpd debug on FortiAnalyzer

#dia de app oftpd 255 <FortiGate IP>

 

Depending on FortiGate and FortiAnalyzer firmware version, there can be issues specific to HA deployments and FortiAnalyzer not trusting the FortiGate certificate or vice versa; you should see this in miglogd debug or oftpd debug.

    Terms & ConditionsAccessibility statement