Fortinet Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
rb400
New Contributor

Diag Debug and Sniffer

Are there any commands to easily reveal what diagnose commands are enabled and/or active?

 

Part 2:  Will all diag commands be disabled (inactive) upon FGT reboot?

 

Part 3: Expanded question:

 

(global) # diag debug info debug output:           disable console timestamp:      disable console no user log message:    disable zebos debug level:      306783954 (0x124926d2)   <<??? CLI debug level:        3 (global) # diag debug reset (global) # diag debug info debug output:           disable console timestamp:      disable console no user log message:    disable CLI debug level:        3

 

What does "zebos debug level:      306783954 (0x124926d2)"   mean?  Obviously, it disappeared after I used the reset command.

 

Part 4:

 

Is the following syntax correct?

 

(root) # diag sniff packet any 'host 10.19.1.231 and port80 and port 443' 1

 

If so, when 10.19.1.231 tries to access any web page via http will the sniff catch the packets?

 

BTW: (root) # diag sniff packet any 'host 10.19.1.231 and icmp' 1 << did catch packets

 

 

 

[align=left]*auto-sig*   rb400 << FGT (v6.2.x) [/align]
3 Solutions
Robin_Svanberg
Contributor

RB400 wrote:

Are there any commands to easily reveal what diagnose commands are enabled and/or active?

 

Part 2:  Will all diag commands be disabled (inactive) upon FGT reboot?

Hi,

 

"diag debug info" will show the debugging levels.

 

All diag commands will be reset upon reboot, or manually by running "diag debug reset".

 

BR Robin

 

Robin Svanberg Network Consultant @ Ethersec AB in Östersund, Sweden

 

robin.svanberg@ethersec.se

View solution in original post

Robin_Svanberg

RB400 wrote:

Robin Svanberg wrote:
...All diag commands will be reset upon reboot, or manually by running "diag debug reset".

I checked the Fortinet KB, documentation, and this forum.

 

Is there any FGT complete guide or cookbook for DIAG concepts and use?

 

Thanks for your reply...a very big help !!

Check out the http://help.fortinet.com/fos50hlp/52data/index.htm#FortiOS/fortigate-toubleshooting-52/troubleshooti... (You will find a lot of other useful information at this site :))

 

Link to all Fortigate docs -> http://docs.fortinet.com/fortigate/admin-guides

 

"Debug output provides continuous, real-time event information. Debugging output continues until it is explicitly stopped or until the unit is rebooted. Debugging output can affect system performance and will be continually generated even though output might not be displayed in the CLI console."

 

BR Robin

 

Robin Svanberg Network Consultant @ Ethersec AB in Östersund, Sweden

 

robin.svanberg@ethersec.se

View solution in original post

neonbit
Valued Contributor

There's a diagnostic wiki page now available that has quite a few diagnose commands and the debug levels you should be running them at. It can be found here: http://wiki.diagnose.fort...com/index.php/Overview

View solution in original post

5 REPLIES 5
Robin_Svanberg
Contributor

RB400 wrote:

Are there any commands to easily reveal what diagnose commands are enabled and/or active?

 

Part 2:  Will all diag commands be disabled (inactive) upon FGT reboot?

Hi,

 

"diag debug info" will show the debugging levels.

 

All diag commands will be reset upon reboot, or manually by running "diag debug reset".

 

BR Robin

 

Robin Svanberg Network Consultant @ Ethersec AB in Östersund, Sweden

 

robin.svanberg@ethersec.se

rb400

Robin Svanberg wrote:
...All diag commands will be reset upon reboot, or manually by running "diag debug reset".

I checked the Fortinet KB, documentation, and this forum.

 

Is there any FGT complete guide or cookbook for DIAG concepts and use?

 

Thanks for your reply...a very big help !!

 

[align=left]*auto-sig*   rb400 << FGT (v6.2.x) [/align]
Robin_Svanberg

RB400 wrote:

Robin Svanberg wrote:
...All diag commands will be reset upon reboot, or manually by running "diag debug reset".

I checked the Fortinet KB, documentation, and this forum.

 

Is there any FGT complete guide or cookbook for DIAG concepts and use?

 

Thanks for your reply...a very big help !!

Check out the http://help.fortinet.com/fos50hlp/52data/index.htm#FortiOS/fortigate-toubleshooting-52/troubleshooti... (You will find a lot of other useful information at this site :))

 

Link to all Fortigate docs -> http://docs.fortinet.com/fortigate/admin-guides

 

"Debug output provides continuous, real-time event information. Debugging output continues until it is explicitly stopped or until the unit is rebooted. Debugging output can affect system performance and will be continually generated even though output might not be displayed in the CLI console."

 

BR Robin

 

Robin Svanberg Network Consultant @ Ethersec AB in Östersund, Sweden

 

robin.svanberg@ethersec.se

Robin_Svanberg
Contributor

RB400 wrote:

Are there any commands to easily reveal what diagnose commands are enabled and/or active?

 

Part 2:  Will all diag commands be disabled (inactive) upon FGT reboot?

 

Part 3: Expanded question:

 

(global) # diag debug info debug output:           disable console timestamp:      disable console no user log message:    disable zebos debug level:      306783954 (0x124926d2)   <<??? CLI debug level:        3 (global) # diag debug reset (global) # diag debug info debug output:           disable console timestamp:      disable console no user log message:    disable CLI debug level:        3

 

What does "zebos debug level:      306783954 (0x124926d2)"   mean?  Obviously, it disappeared after I used the reset command.

I´m not 100% sure, but I think Zebos is the routing engine, and if you enable a diag debug flow the zebos debug level will be set.

Anyone that can confirm this?

 

BR Robin

 

 

Robin Svanberg Network Consultant @ Ethersec AB in Östersund, Sweden

 

robin.svanberg@ethersec.se

neonbit
Valued Contributor

There's a diagnostic wiki page now available that has quite a few diagnose commands and the debug levels you should be running them at. It can be found here: http://wiki.diagnose.fort...com/index.php/Overview