Description | This article explains why FortiGate may be missing logs or events after every reboot and offers potential fixes. |
Scope | Any supported version of FortiGate. |
Solution |
Logs and events can be stored directly on FortiGate in one of two places:
1) In system memory. 2) On the disk.
These can be configured in the GUI under Log & Report -> Log Settings:
- If only memory logging is enabled, FortiGate will store the logs and events in the system memory. These logs will be lost every time the FortiGate is rebooted or power cycled.
- The second option of disk logging, if it is available and feasible, should be used to ensure that logs and events are not lost with a reboot or power cycle.
When using FortiGate devices where disk logging cannot be enabled, it is recommended to use FortiAnalyzer or configure a syslog server to store real-time logs and events.
|