|
In some situations, the Firewall stops sending logs to the FortiAnalyzer, or the connectivity status changes from connected to disconnected randomly.
The article Troubleshooting Tip: FortiGate to FortiAnalyzer connectivity describes how to perform complete troubleshooting.
FortiGate fgtlog or miglogd debug process:
diagnose debug app fgtlog 255
diagnose debug app miglogd 255
diagnose debug enable
To stop debugging:
diagnose de disable
diagnose de reset
If it shows a similar message:
_enqueue_lz4()-684: Failed to allocate memory for log queue.
_append_log_text()-741: Failed to allocate memory for log queue.
_enqueue_lz4()-684: Failed to allocate memory for log queue.
_append_log_text()-741: Failed to allocate memory for log queue
It is possible to change the miglogd-children configuration:
config system global
set miglogd-children 0 ------> Default value.
end
Change it to:
config system global
set miglogd-children 15 <--
end
Complete the procedure by restarting the fgtlog and miglogd processes:
fnsysctl killall miglogd <----- The miglogd daemon is responsible for building and publishing logs.
fnsysctl killall fgtlogd <----- The fgtlogd daemon is responsible for remote logging.
Contact Fortinet TAC Support to do a complete troubleshooting and revision.
Related articles:
Troubleshooting Tip: FortiGate to FortiAnalyzer connectivity
Troubleshooting Tip: FortiGate Logging debugs
Technical Tip: Connectivity issue between FortiGate and FortiAnalyzer (SSL Error)
|
