Skip to main content
Chris_Worthington
New Member
November 6, 2017
Question

How can I see sessions taking up bandwidth - I don't have a 'diag sys' command

  • November 6, 2017
  • 1 reply
  • 8900 views
EDIT: Thank you to the person who gave me links to follow (for some reason I can't reply to his proposed solution). The problem is that any command with "diag sys <whatever>" fails because there is no "diag sys" command. The second link did provide some help with the "diag stats" command but I have fewer options than what's listed on the links. Either way, diag status will offer some help. Thanks     I need to see the top sessions taking up bandwidth using CLI. I don't have a "diag sys" command, which seems to be the popular choice. I do have the web interface but it's kind of worthless because it won't let me SORT by connection bandwidth and I have to wade through pages and pages of connections.   Is there another CLI tool that will give me the current bandwidth [strike]hogs[/strike] users?   Here is my system version: FGT60XXXXXXXXXX $ get system status Version: FortiGate-60D v5.2.10,build0742,161129 (GA)   This is what I get if I hit "diag ?": FGT60Dxxxxxxxxxx $ diag antivirus antivirus central-mgmt Central management. debug debug disktest Disk test endpoint Endpoint compliance diagnostics. fdsm FortiCloud/FortiManager Service. firewall Firewall forticare FortiCare Service. forticlient forticlient fortitoken FortiToken hardware hardware ip ip ips ips ipv6 ipv6 lldptx Link Layer Transmission Protocol (LLDP) Transmitter diagnostics. log log netlink netlink npl nplite npu Network Processing Unit settings settings sniffer Sniffer command. spamfilter spamfilter src-vis Source visibility diagnostics. stats Usage statistics. switch-controller fortiswitch controller traffictest Offloading traffic test using internal TX/RX user User vpn vpn wacs Web cache DB daemon. wad WAD diagnostics. wadbd WAN accelerator DB daemon. webfilter webfilter

    1 reply

    emnoc
    New Member
    November 6, 2017

    Are running muti-vdoms; If yes   try the diag sys  session command per-vdom, use filters ,etc....

     

    http://socpuppet.blogspot.com/2013/06/diag-system-session-quick-way-find.html

     

     

    http://socpuppet.blogspot.com/2014/09/exploring-diag-stats-fortigate.html

     

    Chris_Worthington
    New Member
    November 7, 2017

    Thank you, Emnoc,  for the links to follow. The problem is that any command with "diag sys <whatever>" fails because there is no "diag sys" command. The second link did provide some help with the "diag stats" command but I have fewer options than what's listed on the links. Either way, diag status will offer some help. Thanks  

    UPDATE: It looks like I don't have privileged mode/enabled mode access to this FW. But I was able to use diag stats app-bandwidth to get the top 20 apps, then use diag stats app-usage-ip with the app ip from the previous command to get the IP addresses using the most bandwidth. This gives me what I need.

     

    If there is a way to match the IP address with the machine name that would be ideal, but I can do that in Linux using the "nbstat" command.