FortiGate
FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
sagha
Staff
Staff
Article Id 249626
Description This article explains why FortiGate may be missing logs or events after every reboot and offers potential fixes.
Scope Any supported version of FortiGate.
Solution

Logs and events can be stored directly on FortiGate in one of two places:

 

1) In system memory.

2) On the disk.

 

These can be configured in the GUI under Log & Report -> Log Settings

 

image.png

 

- If only memory logging is enabled, FortiGate will store the logs and events in the system memory. These logs will be lost every time the FortiGate is rebooted or power cycled. 

 

- The second option of disk logging, if it is available and feasible, should be used to ensure that logs and events are not lost with a reboot or power cycle.

 

image.png

 

When using FortiGate devices where disk logging cannot be enabled, it is recommended to use FortiAnalyzer or configure a syslog server to store real-time logs and events. 

 

image.png

 

image.png

Contributors