Troubleshooting Tip: Loopback logs appear periodically after an upgrade

[Hiromu]

Description	This article describes the cause of HTTP logs showing the loopback source IP address (127.0.0.1) after an upgrade.
Scope	FortiGate v7.2/v7.4/v7.6.
Solution	After an upgrade, the following traffic log may be generated at five-minute intervals. date=YYYY-MM-DD time=00:00:00 devname="FORTINET" devid="FG3H0E5811103124" eventtime=1749394956898473462 tz="+0900" logid="0001000014" type="traffic" subtype="local" level="notice" vd="root" srcip=127.0.0.1 srcport=1342 srcintf="root" srcintfrole="undefined" dstip=127.0.0.1 dstport=80 dstintf="root" dstintfrole="undefined" srccountry="Reserved" dstcountry="Reserved" sessionid=51655692 proto=6 action="close" policyid=0 service="HTTP" trandisp="noop" app="HTTP" duration=2 sentbyte=400 rcvdbyte=670 sentpkt=6 rcvdpkt=4. This behavior is expected and is output by FortiCron, which checks whether the Node.js daemon is running. FortiCron monitors Node.js at regular intervals, and this check generates local traffic that is recorded as a local traffic session. Log consistency can be confirmed by verifying that the timestamps of the Node.js debug log align with the traffic log. FORTINET # diagnose debug application nodejs -1 FORTINET # diagnose debug enable [node Node API Handler - 1751274021 info] - New GET reqest for "/api/v2/service/health-check/ping" from "127.0.0.1:9064" [node Node API Handler - 1751274021 info] - User-Agent: "undefined" [node Node API Handler - 1751274021 info] - Checking request content. [node Node API Handler - 1751274021 info] - Local Node.JS API request authorized. [node Node API Handler - 1751274021 info] - endpoint: health-check, action: ping [node Node API Handler - 1751274021 info] - remoteIpAddress: 127.0.0.1 [node Node API Handler - 1751274021 info] - Completed request for "/api/v2/service/health-check/ping" (HTTP 200).