Skip to main content
hpadm
hpadm
New Member
September 6, 2022
Question

Strange excessive log polling behavior of FortiClient and FortiTray

  • September 6, 2022
  • 2 replies
  • 5790 views

While troubleshooting a FortiClient VPN issue, in Sysinternals Process Monitor I noticed that the client components are generating hundreds of events per second, continuously polling FortiTray_1.log, guimessenger_1.log and sslvpndaemon_1.log trace files in the user's AppData. No data is written, they're just opened, queried and closed. This happens even on a fresh unconfigured 7.0.6 install. It is just a minor nuisance and easy to filter oyt, but it might be indicative of some sort of internal application issue because for me it is very rare to encounter software with this kind of behavior. I figured I'd mention it here for it to maybe get noticed.

 

Additionally, I've seen that sslvpndaemon_1.log will log "[sslvpndaemon 515 debug] FortiSslvpn: CSslvpnBase::RefreshConnection() Called." every 2 seconds once it's started, and will keep doing it even after the vpn is disconnected. None of the log-related items in the xml config or in the windows registry seem to have an effect. It is unusual to see debug-level verbosity being used in production like that. The other two files are written less frequently.

 

I have checked an earlier 6.5 install and saw that none of these files were being logged, the appdata trace dir was empty. That also means that none of the abovementioned polling was happening.

 

forticlient-log-polling.png

2 replies

btan
Staff & Editor
btan
Staff & Editor
September 6, 2022

Hi hpadm,

 

When logging level is set to "debug", FCT will write into logs\trace\ folder, it is expected.

We only set to "debug" when we need troubleshooting.

You can edit the logging level in FCT > settings > log > log level > change to Information if you do not want excessive logging.

If FCT is connected to EMS, you will have to configure this under Endpoint profile.

 

hpadm
hpadmAuthor
New Member
September 6, 2022

Well that's the thing - it seems these components totally ignore all logging settings and just do their own thing.
I have set log level to Emergency in the UI. I have set it to 0 in the xml config. I have flipped every log-related setting in the config to disabled. I went into the HKLM registry, went through all the components and set logging to 0 and loglevel to 0. There's also the 'fctlog' node, but it only has 'flags' and max log size. None of these had any visible effect, the trace logs were still being produced the same way.

Avihaa
Avihaa
New Member
September 6, 2022

This article provides the solution when the error 'unable to establish the VPN connection. The VPN server may be unreachable (-20199)' is obtained in FortiClient trying to connect to the SSL-VPN. 1) Run the Wan miniport repair tool (or version 2). 2) Restart the computer and test VPN access again.

 

 

anonigviewer

bingenerator

Terms & ConditionsAccessibility statement