FortiGate
FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
caunon
Staff
Staff
Article Id 389655
Description

This article describes the situation where the syslogd daemon with v7.2.7 build1577 often crashes. It causes the issue that FortiGate can not send logs to the Syslog server properly.

Scope

FortiGate v7.2.7

Solution

The syslogd daemon often crashes after upgrading to v7.2.7 build1577. When configuring syslog settings at FortiGate, FortiGate can not send Syslog to the Syslog server properly.

 

Run the CLI command at FortiGate, and it shows the logs as below.

 

diagnose debug crashlog read

2387: 2024-04-19 09:46:24 <26246> firmware FortiGate-VM64 v7.2.7,build1577b1577,240131 (GA.M) (Release)

2388: 2024-04-19 09:46:24 <26246> application syslogd

2389: 2024-04-19 09:46:24 <26246> *** signal 11 (Segmentation fault) received ***

2390: 2024-04-19 09:46:24 <26246> Register dump:

2391: 2024-04-19 09:46:24 <26246> RAX: 00007f32fdc74000   RBX: 000000000000007d

2392: 2024-04-19 09:46:24 <26246> RCX: 00007f33046f7733   RDX: 000000000008af2d

2393: 2024-04-19 09:46:24 <26246> R08: 0000000000001430   R09: 000000000000007d

2394: 2024-04-19 09:46:24 <26246> R10: 000000000000037a   R11: 0000000000000246

2395: 2024-04-19 09:46:25 <26246> R12: 0000000010ab9a30   R13: 0000000010ab8680

2396: 2024-04-19 09:46:25 <26246> R14: 0000000010ab71b0   R15: 00007ffe33a005c0

2397: 2024-04-19 09:46:25 <26246> RSI: 0000000010ab8680   RDI: 000000000000000f

2398: 2024-04-19 09:46:25 <26246> RBP: 00007ffe33a00590   RSP: 00007ffe33a00540

2399: 2024-04-19 09:46:25 <26246> RIP: 000000000298dc34   EFLAGS: 0000000000010246

2400: 2024-04-19 09:46:25 <26246> CS:  0033   FS: 0000   GS: 0000

2401: 2024-04-19 09:46:25 <26246> Trap: 000000000000000e   Error: 0000000000000004

2402: 2024-04-19 09:46:25 <26246> OldMask: 0000000000000000

2403: 2024-04-19 09:46:25 <26246> CR2: 00007f32fdd027cd

2404: 2024-04-19 09:46:25 <26246> stack: 0x7ffe33a00540 - 0x7ffe33a01170

2405: 2024-04-19 09:46:25 <26246> Backtrace:

2406: 2024-04-19 09:46:25 <26246> [0x0298dc34] => /bin/syslogd

2407: 2024-04-19 09:46:25 <26246> [0x0298e076] => /bin/syslogd

2408: 2024-04-19 09:46:25 <26246> [0x02a65156] => /bin/syslogd

2409: 2024-04-19 09:46:25 <26246> [0x02986dc0] => /bin/syslogd

2410: 2024-04-19 09:46:25 <26246> [0x00449f6f] => /bin/syslogd

2411: 2024-04-19 09:46:25 <26246> [0x0044f498] => /bin/syslogd

2412: 2024-04-19 09:46:25 <26246> [0x0044fc8a] => /bin/syslogd

2413: 2024-04-19 09:46:25 <26246> [0x004524af] => /bin/syslogd

2414: 2024-04-19 09:46:25 <26246> [0x00452dd9] => /bin/syslogd

2415: 2024-04-19 09:46:25 <26246> [0x7f330462fdeb] => /usr/lib/x86_64-linux-gnu/libc.so.6

2416: 2024-04-19 09:46:25 (__libc_start_main+0x000000eb) liboffset 00023deb

2417: 2024-04-19 09:46:25 <26246> [0x004450da] => /bin/syslogd

2418: 2024-04-19 09:46:25 <26246> fortidev 6.0.1.0005

 

The issue has been reported in internal Engineering ticket 1006617 and is resolved in v7.2.9 and v7.4.4.