Technical Tip : How to check and troubleshoot incorrect information sent to syslog server by FortiExtender

[pprince]

Description	This article describes how to check and troubleshoot incorrect information sent to the syslog server by FortiExtender. For example:  FortiExtender is sending the correct hostname to the syslog server (Sending Serial number instead of the hostname). Refer to the below configuration on FortiExtender : "global": { "hostname": "TAC",  --------------->Configured hostname "timezone": 26, "auto-install-image": "disable", "default-image-file": "", "mdm-fw-server": "fortiextender-firmware.forticloud.com", "os-fw-server": "fortiextender-firmware.forticloud.com" Syslog config:     "syslog": {             "remote-servers": {                 "1": {                     "ip": "172.2X.6X.2X",    -----------------> Syslog server                     "port": 1514                 }             },             "statistic-report": {                 "status": "enable",                 "interval": 30,                 "cpu-usage": {                     "threshold": 70,                     "variance": 5                 },                 "memory-usage": {                     "threshold": 50,                     "variance": 5                 },                 "cpu-temperature": {                     "threshold": 80,                     "variance": 5
Scope	FortiExtender.
Solution	Upgrade the FortiExtender to the latest available version to start troubleshooting the issue. Check if all the required processes are running on the FortiExtender. get system app-status name type command pid state SYSLOGD APP_T_MONIPID syslogd 1126 RUNNING CONFIG APP_T_INFRA json_config 1133 RUNNING ZEBRA APP_T_MONIPID zebra 1135 RUNNING Perform a reboot/SSH/console/HTTPS/HTTP connection on the FortiExtender to check if the issue persists in all the scenarios. For example: FortiExtender is sending the following details : <150>Mar 10 14:56:16 event: timestamp="1741618576" hostname="TAC" type="event" subtype="config" action="CLI configuration update" logdesc="FortiExtender configuration changed by JCLI (appid#10)" msg="/system/global/hostname changed from () to TAC " 10.37.165.197 10/03 20:26:18.140 <150>Mar 10 14:56:37 event: timestamp="1741618597" hostname="TAC" type="event" subtype="system" action="system status" logdesc="system status" msg="Memory usage rate warning: current Memory usage rate:19" 10.37.165.197 10/03 20:26:39.099 <150>Mar 10 14:56:37 event: timestamp="1741618597" hostname="TAC" type="event" subtype="system" action="system status" logdesc="system status" msg="Memory usage rank: Summary: slab:16724 buf:11520 cache:40020 dirty:0 write:0  top1: 11924 extenderd, top 10.37.165.197 10/03 20:26:39.251 <150>Mar 10 14:56:37 event: timestamp="1741618597" hostname="TAC" type="event" subtype="system" action="system status" logdesc="system status" msg="CPU temperature warning: current CPU temperature:43.2" 10.37.165.197 10/03 20:26:39.300 <142>Mar 10 14:56:37 statistic: timestamp="1741618597" hostname="TAC" type="statistic" subtype="config" action="system statistic" logdesc="system statistic" msg="Performance statistics: current CPU:0.0, memory:19, CPU temperature: 43.2 degree Celsius" 10.37.165.197 10/03 20:26:39.363 After reboot, the hostname shows as the serial number instead of 'TAC': <150>Jan 1 00:00:46 event: timestamp="46" hostname="FXE11FS222xxxxxx" type="event" subtype="config" action="APP configuration update" logdesc="FortiExtender configuration changed by NETD (appid#6)" msg="/router/target/target.port4/next-hop changed from ( 10.37.165.197 10/03 20:28:38.242 <150>Jan 1 00:00:56 event: timestamp="56" hostname="FXE11FS222024633" type="event" subtype="system" action="system status" logdesc="system status" msg="Memory usage rate warning: current Memory usage rate:17" 10.37.165.197 10/03 20:28:48.405 <150>Jan 1 00:00:56 event: timestamp="56" hostname="FXE11FS222xxxxxx" type="event" subtype="system" action="system status" logdesc="system status" msg="Memory usage rank: Summary: slab:16560 buf:11180 cache:38836 dirty:0 write:0  top1: 11844 extenderd, t 10.37.165.197 10/03 20:28:48.466 <150>Jan 1 00:00:56 event: timestamp="56" hostname="FXE11FS222xxxxxx" type="event" subtype="system" action="system status" logdesc="system status" msg="CPU temperature warning: current CPU temperature:45.9" 10.37.165.197 10/03 20:28:48.519 Collect packet capture on the FortiExtender interface of the FortiGate to check if FortiExtender is sending out the correct hostname.   Kill the syslogd process on the FortiExtender : execute restartapp SNMPD <pid> Example: execute restartapp SNMPD 1126 Related document:  Configure the system syslog