FortiGate
FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
rvijayaraj
Staff
Staff
Article Id 387313
Description This article describes the requirement of diagnostic outputs and debugs for certain issues.
Scope FortiGate.
Solution

Logging and debugging are both essential tools for troubleshooting, but they serve different purposes.

 

Logging records events and information for later analysis and troubleshooting, while debugging is the process of actively finding and fixing errors.

 

Debugging helps identify the root cause of an issue, while logging provides a trail of clues for later investigation.

 

Even though the logs provide information for later analysis, they contain minimal information, which the TAC will have a hard time concluding or finding a cause for the issue.

 

Debug logs, which are taken at the time of an issue, provide more vital information that will be required for identifying and fixing the issue. 

 

The example below will show the difference between the logs and debugs collected for the same issue : 

 

Scenario: High CPU.

 

The system events below show that the CPU is at 99%.

 

type="event" subtype="system" logdesc="System performance statistics" cpu=99 mem=25 totalsession=1081381 disk=0 bandwidth="1788670/1766901" setuprate=9220 sysuptime=378642 waninfo="N/A" concurrent sessions: 1081381, setup-rate: 9220"


type="event" subtype="system" logdesc="System performance statistics" cpu=99 mem=25 totalsession=1107426 disk=0 bandwidth="10376347/10285598" setuprate=6844 sysuptime=378342 waninfo="N/A" concurrent sessions: 1107426, setup-rate: 6844"

 

The logs indicate the CPU was at 99% but does not describe what was causing the CPU to go high. 

 

The below diagnostic command shows what process was consuming more CPU at the time issue. 

 

diagnose sys top


09:17:10 AM up 20 days, 13 hours and 3 minutes
0U, 0N, 0S, 88I, 0WA, 0HI, 12SI, 0ST; 7978T, 2521F
ipsengine 645 S 99.0 2.7 0              -----------> 
cmdbsvr 204 S 2.0 0.4 0
updated 253 S 1.5 0.4 4
miglogd 434 S 1.0 1.1 2
fltund 283 S 1.0 0.3 4
dnsproxy 18305 S 1.0 0.3 3

 

Conclusion : 

Ultimately, for certain issues like the above, diagnostic command outputs and debugs will be required to pinpoint the issue.