Technical Tip: Performing general healthcheck on a FortiGate

[kcheng]

Description	This article describes how to perform a general health check of a FortiGate. It provides steps to retrieve logs and perform a health check on the device.
Scope	FortiGate.
Solution	Run the command 'get sys status' to display versions of firmware, FortiGuard engines, and other system information. Run the command 'get sys performance status' to display CPU and memory usage, network usage, and session setup rate. Run the command 'get hardware status' to show ASIC type, hard disk size, RAM size, CPU cores, network card type, etc. Run the command 'fnsysctl ifconfig' to show a summary for all interfaces, including MAC/HW address, IP address, MTU, Metric, TX, RX, collisions, interface queue size, etc. Run the command 'get hardware nic <port>' to show port hardware details, MAC/HW address, link status, link settings, and traffic counters. Run the command 'diagnose sys top 5 20' to show top processes information for 20 processes and refresh every 5 seconds. Run the command 'fnsysctl ps' to show the list of all processes active in the FortiGate. Run the command 'diagnose sys top-mem to show the top 5 processes using the most memory. Run the command 'get sys session-info full-stat' to show session info statistics. Run the command 'diagnose debug crashlog read' to show debug crashlog output. Run the command 'diagnose debug config-error-log read' to show config error logs. Run the command 'diagnose hardware sys memory' to show system memory information. Run the command 'diagnose system top-fd' to show file descriptors memory information. Run the command 'diagnose hardware sys conserve' to check if the FortiGate is in conserve mode. Run the command 'diagnose sys session list' to check session creation and teardown rates. Run the command 'diagnose alertconsole list' to show the current alert messages. In general, FortiGate is in a healthy state based on the following: FortiGate did not show any abnormality in CPU usage by a certain daemon continuously. FortiGate did not show any abnormality in memory usage by a certain daemon. There is no continuous crashlog observed on the FortiGate crashlog output. FortiGate conserve mode is off Note: Super Admin privilege is required to run the 'fnsysctl' command. Otherwise, FortiGate will return an error, as explained in this KB article: Troubleshooting Tip: fnsysctl command returns Unknown action 0 If the FortiGate is suspected to fail on the hardware level, the HQIP test would be more appropriate to check: Technical Tip: RMA: HQIP test (with built-in FortiOS diagnostic commands