FortiGate
FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
cravikumar
Staff
Staff
Article Id 415060
Description This article describes an issue where an automation stitch configured to trigger an alert email during a device reboot fails to send the email during the actual reboot process.
Scope FortiGate.
Solution

During test triggers, the email alert is successfully sent and received, and debug logs indicate 'send mail success'. However, during an actual reboot - initiated through either the CLI or GUI - the debug logs show that the process terminates before the email is sent.

 

Automation stitch configuration:

 

config system automation-action
    edit "Email"
        set action-type email
        set email-to "test@fortinet.com"
        set email-subject "FGT-Reboot"
    next
end

config system automation-trigger
    edit "Reboot"
        set description "A FortiGate is rebooted."
        set event-type reboot
    next
end

config system automation-stitch
    edit "Reboot_FGT"
        set trigger "Reboot"
        config actions
            edit 1
                set action "Email"
                set required enable
            next
        end
    next
end

 

Debugs during the test trigger:

 

diagnose debug reset
diagnose debug application alertmail -1
diagnose debug enable

 

mail_info:
from:fortinet-notifications.com user:DoNotReply@fortinet-notifications.com
mail_info:
reverse path:DoNotReply@fortinet-notifications.com
user name:DoNotReply
to0:test@fortinet.com
<==_init_mail_info
create session
resolve fortinet-notifications.com to 1 IP
> send mail
connecting to 208.x.x.x port 465
send mail 0x7f41fddb3f10 session 0x7f41fddb44f0
session_io_event: creating ssl structure for session 0x7f41fddb44f0
ssl_init
create_ssl_ctx
create_ssl: 0x7f41fdf30250
session 0x7f41fddb44f0, SSL connected
session: 0x7f41fddb44f0, rsp_state: greeting, code: 220
session: 0x7f41fddb44f0, rsp_state: ehlo, code: 250
session: 0x7f41fddb44f0, rsp_state: mail, code: 250
session: 0x7f41fddb44f0, rsp_state: rcpt, code: 250
session: 0x7f41fddb44f0, rsp_state: data, code: 354
= send len: 540
session: 0x7f41fddb44f0, rsp_state: data2, code: 250
session: 0x7f41fddb44f0, rsp_state: quit, code: 221
session finined
_session_on_destroy
<== send mail success, m = 0x7f41fddb3f10 s = 0x7f41fddb44f0

 

FortiGate reboot log excerpt:

 

date=2025-10-14 time=08:35:08 eventtime=1760445308267750317 tz="-0400" logid="0100032138" type="event" subtype="system" level="critical" vd="root" logdesc="Device rebooted" user="admin" ui="jsconsole(10.x.x.x)" action="reboot" msg="User admin rebooted the device from jsconsole(10.x.x.x)."

 

Debug output during an actual reboot shows '':

 

diagnose debug reset
diagnose debug application alertmail -1
diagnose debug enable

 

mail_info:
from:fortinet-notifications.com user:DoNotReply@fortinet-notifications.com
mail_info:
reverse path:DoNotReply@fortinet-notifications.com
user name:DoNotReply
to0:test@fortinet.com
<==_init_mail_info
create session

The system is going down NOW !!
terminate alert mail
resolve fortinet-notifications.com to 0 IP
could not resolve server's IP address: fortinet-notifications.com

 

This is a known issue with FortiGates in HA Clusters that will be addressed in the upcoming FortiOS v7.4.10, v7.6.5 and v8.0.0 release.

 

Related document:

Technical Tip: How to configure alert email settings