| Description |
This article describes the implications of a GUI warning that FortiGate is taking longer than expected to fetch data from FortiGate Cloud. |
| Scope |
FortiGate v7.4.4, v7.4.5, v7.4.6 and v7.4.7. |
| Solution |
The warning 'Fetching data from Forticloud is taking longer than expected. Suggest trying a different log source or check the availability of FortiGate Cloud' may be seen when attempting to view forward traffic logs by navigating to Log & Report -> Forward Traffic Logs with the log location set to 'FortiGate Cloud'.
As a result of the warning, an administrator might assume that no logs are being retrieved, however this is usually not the case. When this warning is seen, it may take a minute or more to see the retrieved logs.
When the FortiGate has no connectivity to FortiGate Cloud, this warning is not seen. Instead, the Log page should show 'No Results' within a few seconds.
Behavior Trigger: The warning is triggered when the device's initial requests to FortiGate Cloud do not return any logs within 10 seconds. However, response times of greater than 10 seconds from the FortiGate Cloud service can be expected in certain circumstances if there are a lot of logs to search and if the requested filter only captures rare events.
Solution: The timer for the warning has been changed to 30 seconds in v7.4.8 and v7.6.3. This makes a false positive warning less likely. After the change, the administrator is more likely to see a notice allowing them to end the search early and view available logs, instead of the 'Fetching data from FortiCloud is taking longer than expected' warning with no option to end the search early.
Logs Required for investigation:
diagnose debug application forticldd -1 diagnose debug application httpsd -1 diagnose debug console timestamp enable diagnose debug enable
Reproduce the issue.
diagnose debug reset execute log filter category 0 (0= forward traffic) execute log filter device 4 (4= Forticloud) execute log display
|
