Technical Tip: Filtering crash logs with time frame

[VinayHM]

Description	This article describes how to filter the crashlogs by year.
Scope	FortiGate.
Solution	After running the command to get crashlogs, it outputs a large amount of log data. To filter and view recent crash logs after executing 'diagnose debug crashlog read', Several techniques can be employed: To check only the crash diagnose debug crashlog read | grep "crash" chameleon-kvm97 # diagnose debug crashlog read | grep "crash" 112: 2025-05-23 19:08:59 wad crashed 1 times. The latest crash was at 2025-05-23 18:08:58. 224: 2025-06-04 22:08:04 snmpd previously crashed 1 times. The last crash was at 2025-06-04 21:25:00. 263: 2025-06-04 23:08:06 snmpd crashed 2 times. The latest crash was at 2025-06-04 22:08:04. 378: 2025-06-06 18:59:58 ipsengine 07.006.1040 crashed 1 times. The latest crash was at 2025-06-06 681: 2025-06-25 16:40:59 ipsengine 07.006.1040 previously crashed 1 times. The last crash was at 751: 2025-06-25 17:41:02 ipsengine 07.006.1040 crashed 2 times. The latest crash was at 2025-06-25 824: 2025-06-25 20:06:28 ipsengine 07.006.1040 crashed 1 times. The latest crash was at 2025-06-25 896: 2025-07-01 23:32:40 ipsengine 07.006.1040 crashed 1 times. The latest crash was at 2025-07-01 974: 2025-07-03 23:15:47 ipsengine 07.006.1040 crashed 1 times. The latest crash was at 2025-07-03 1132: 2025-07-22 07:38:52 httpsd previously crashed 1 times. The last crash was at 2025-07-22 07:38:03. 1172: 2025-07-22 07:39:39 httpsd previously crashed 2 times. The last crash was at 2025-07-22 07:38:52. 1212: 2025-07-22 07:39:44 httpsd previously crashed 3 times. The last crash was at 2025-07-22 07:39:39. 1252: 2025-07-22 07:42:36 httpsd previously crashed 4 times. The last crash was at 2025-07-22 07:39:44. 1292: 2025-07-22 07:44:04 httpsd previously crashed 5 times. The last crash was at 2025-07-22 07:42:36. 1332: 2025-07-22 07:44:04 httpsd previously crashed 6 times. The last crash was at 2025-07-22 07:44:04. 1387: 2025-07-22 07:44:28 httpsd previously crashed 7 times. The last crash was at 2025-07-22 07:44:04. 1427: 2025-07-22 08:44:29 httpsd crashed 8 times. The latest crash was at 2025-07-22 07:44:28. 1475: 2025-08-07 22:52:42 httpsd crashed 1 times. The latest crash was at 2025-08-07 21:52:38. 1564: 2025-09-16 06:13:12 httpsd crashed 1 times. The latest crash was at 2025-09-16 05:13:10. To see only the conserve mode logs: chameleon-kvm97 # diagnose debug crashlog read | grep "Kernel enters memory conserve mode" 469: 2025-06-10 19:00:41 green="1635 MB" msg="Kernel enters memory conserve mode" 1027: 2025-07-10 18:26:26 green="1634 MB" msg="Kernel enters memory conserve mode" 1620: 2025-09-19 17:24:17 green="1633 MB" msg="Kernel enters memory conserve mode" 1724: 2025-09-19 18:14:18 green="1633 MB" msg="Kernel enters memory conserve mode" 1828: 2025-09-19 18:22:09 green="1633 MB" msg="Kernel enters memory conserve mode" 1932: 2025-09-19 18:54:45 green="1633 MB" msg="Kernel enters memory conserve mode" 2036: 2025-09-19 19:43:34 green="1633 MB" msg="Kernel enters memory conserve mode" Crash logs include timestamps. Grep to filter for specific dates or times: diagnose debug crashlog read | grep "YYYY-MM-DD" <----- Replace YYYY-MM-DD with the relevant date. FGT # diagnose debug crashlog read | grep 2025 915: 2025-01-02 13:12:35 the killed daemon is /bin/sflowd: status=0x0 916: 2025-01-02 13:12:35 the killed daemon is /bin/sflowd: status=0x0 917: 2025-01-02 14:39:37 the killed daemon is /bin/sflowd: status=0x0 918: 2025-01-02 14:39:37 the killed daemon is /bin/sflowd: status=0x0 919: 2025-01-03 10:45:37 the killed daemon is /bin/sflowd: status=0x0 920: 2025-01-03 10:45:37 the killed daemon is /bin/sflowd: status=0x0 921: 2025-01-04 23:01:23 the killed daemon is /bin/sflowd: status=0x0 922: 2025-01-04 23:01:23 the killed daemon is /bin/sflowd: status=0x0 923: 2025-01-08 00:01:10 the killed daemon is /bin/csfd: status=0x0 924: 2025-01-08 00:01:10 the killed daemon is /bin/eap_proxy: status=0x0 925: 2025-01-23 08:11:20 the killed daemon is /bin/sflowd: status=0x0 926: 2025-01-23 08:11:20 the killed daemon is /bin/sflowd: status=0x0 927: 2025-02-03 17:12:07 the killed daemon is /bin/sflowd: status=0x0 928: 2025-02-03 17:12:07 the killed daemon is /bin/sflowd: status=0x0 929: 2025-02-08 10:28:45 the killed daemon is /bin/sflowd: status=0x0 930: 2025-02-08 10:28:45 the killed daemon is /bin/sflowd: status=0x0 931: 2025-02-08 12:49:28 the killed daemon is /bin/sflowd: status=0x0 932: 2025-02-08 12:49:28 the killed daemon is /bin/sflowd: status=0x0