No logs visible in UI...

Question

On a couple of our production AWS On-Demand Fortigates, no logging is visible in the UI. I know logging is occurring because we also log to ELK. Additionally I cannot start a packet capture in the UI. I have double checked that informational logging and disk logging is enabled.

The only way I've been able to get this functionality back is to restart the instance.

Any help would be appreciated.

cpagare · Answer

For traffic logs, please cross-verfiy if the policies have log "All sessions" enabled or not. To verify the Forward Traffic logs, "All sessions" in the policies need to be enabled.

Please also check the below settings, you can enable the type of logs under disk settings (same is for memory if memory logging is enabled) :

config log disk filter

LAB1 (filter) # sh full-configuration
config log disk filter
set severity information
set forward-traffic enable
set local-traffic enable
set multicast-traffic enable
set sniffer-traffic enable
set anomaly enable
set voip enable
set dlp-archive enable
set gtp enable
set filter ''
set filter-type include
end

++++++++++++++++++++++++

You can also try restarting the miglogd process by running the below command:

#diag sys kill 11 <PID>

or fnsysctl killall miglogd

Please follow the below document for your reference:

https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-FortiGate-Logs-are-not-displayed-in/ta-p/194193