Description
This article describes how to collect debug information to troubleshoot web management interface issues.
Scope
FortiGate v6.2.2+, v6.4.0+, v7.0.0+, v7.2.0+, v7.4.0+, v7.6.0+.
Requires Google Chrome or a Chromium-based browser that has access to the Google Chrome store.
See this article for non-Google browsers: Technical Tip: How to install the Fortinet Support Tool extension on Edge and Brave.
Solution
For troubleshooting issues related to the web management interface of FortiGate (GUI), the debug level for the HTTPS daemon is useful, which can be retrieved with the commands below.
diagnose debug reset
diagnose debug console timestamp enable
diagnose debug application httpsd -1
diagnose debug enable
To stop the debug:
diagnose debug disable
diagnose debug reset
However, a Google Chrome Extension can be leveraged to collect several other pieces of information at once, which may be extremely helpful for troubleshooting.
This Google Chrome extension is called 'Fortinet Support Tool' and it is publicly available on the Google Chrome Web Store.
Fortinet Support Tool - Google Chrome Extension
It communicates with a FortiGate via the Chrome extension API and may collect the following during a capture:
- A video recording.
- FortiGate meta information.
- Client and browser meta information.
- HTTP network logs.
- Various daemon debug logs (cmdb, node, httpsd, csfd, miglogd, sslvpnd).
- JavaScript console logs.
- FortiGate memory and CPU usage over time.
- Client memory and CPU usage over time.
Note.
Some daemons may only be available with FortiOS firmware v7.0 and above.
Creating a Capture.
Fortinet Support Tool is currently available for the Google Chrome browser and FortiGate running firmware version 6.2.2 and above.
To create a new capture, log in to a FortiGate and locate the extension added previously at the top right section of the browser, as shown below. The red icon indicates FortiGate is ready to begin capture.
Note.
The administrator profile must have read/write access to at least the 'System' category.
Select the icon, and a dropdown will appear with information on the current FortiGate.
Select the button labeled 'New Capture'.
After selecting 'New Capture', a new window will be presented with a form with options to choose from, such as 'File Name', 'Device Configuration', and daemons to have debug enabled.
After selecting 'Start Capture', choose the screen on which the issue will be replicated, and select 'Share'. The header within the FortiOS GUI will now display a red timer indicating the duration of the capture.
Note.
The maximum duration of capture is 10 minutes.
With the capture now running, the issue can be reproduced, and data will be gathered based on options previously selected.
At any point in time, the capture can be stopped by selecting the red button from the above image. Once capture is ended, a zip file will be downloaded.
Viewing a Capture.
Once a capture has been created, it can be viewed at any time by selecting the 'View Capture' button in the Fortinet Support Tool extension dropdown.
Note.
The icon does not need to be read to view a capture.
A new tab will now open in the browser. Select the capture zip file or drag and drop the file into this page.
After selecting a capture file, a dashboard will be presented with information about the capture.
In the top left corner is a video of the capture, bottom left is a resource usage chart, and on the right-hand side is either general information or a log stream.
From the dropdown on the right-hand side, the default option is 'Capture Summary', but it contains the options presented in the image below.
Note.
The content of daemon logs will show logs up until the current video time has elapsed.
Play or drag the video timeline to show more logs as the video progresses.
This allows for the easier association of a visual event with a particular log entry.
Note.
Starting from FortiOS 7.6.3 version a new feature was added , the Fortinet Support Tool for Capturing Incidents. It captures the real-time debugging using a REST API key generated on the FortiGate. The tool can run for up to 48 hours to increase the chance of capturing incidents. For more information refer to Fortinet Support Tool for capturing incidents
Related article:
Technical Tip: Install Fortinet Support Tool Chrome extension without internet access
