Fortinet Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
BensonLEI
New Contributor

Strange syslog for Fortigate device

Hi, Guys,

 

We found some strange syslog as the following, we have not configured or defined these policies ?

Any recommendation to fix these problems:

 

uID : 5025117 Date : Today 03:46:51 Host : 10.16.9.6 Messagetype : Syslog Facility : LOCAL7 Severity : ERR Syslogtag : date=2020-12-23 Checksum : 0 Message time=03:46:50 devname="Forti400e_Fw02" devid="FG4H000000000004" logid="1501054200" type="utm" subtype="dns" eventtype="dns-response" level="error" vd="root" eventtime=1608709611360453548 tz="-0400" policyid=0 sessionid=0 srcport=0 srcintf="unknown0" srcintfrole="undefined" dstip=169.254.0.2 dstport=53 dstintf="unknown0" dstintfrole="undefined" proto=17 xid=47105 qname="login.microsoft.com " qtype="A" qtypeval=1 qclass="IN" msg="A DNS resolution error occurs" action="pass" error="DNS query timeout"

 

 

 

Details for the syslog messages with id '5032066' uID : 5032066 Date : Today 04:03:27 Host : 10.16.9.6 Messagetype : Syslog Facility : LOCAL7 Severity : WARNING Syslogtag : date=2020-12-23 Checksum : 0

Message time=04:03:27 devname="Forti400e_Fw02" devid="FG4H000000000005" logid="0113022923" type="event" subtype="sdwan" level="warning" vd="root" eventtime=1608710608185897467 tz="-0400" logdesc="Virtual WAN Link status" eventtype="Service" serviceid=3 service="To_01DC" msg="Service disabled caused by no outgoing path."

 

 

 

Many thanks

 

 

2 Solutions
Benoit_Rech_FTNT

Hello Benson,

this syslog is not related to firewall policy (we can see that is the syslog the policy-id is set to 0) but are generated by the system: * first one: a DNS query haven't received a response * second one: routing issue on SD-WAN, with on path unavailable. There a some filter you can apply on syslog, and also configure filter on event.

#config log syslogd filter

# get severity : information forward-traffic : enable local-traffic : enable multicast-traffic : enable sniffer-traffic : enable anomaly : enable voip : enable gtp : enable filter : filter-type : include

 

and

 # config log eventfilter

 # get event : enable system : enable vpn : enable user : enable router : enable wireless-activity : enable wan-opt : enable endpoint : enable ha : enable security-rating : enable fortiextender : enable connector : enable

 

Best regards, Benoit

View solution in original post

emnoc
Esteemed Contributor III

OP

 

Also fortios has log reference  on their website that will give you inside details on log structure

 

e.g

 

https://docs.fortinet.com/document/fortigate/6.2.0/fortios-log-message-reference/656858/log-id-defin...

 

Ken Felix

 

PCNSE 

NSE 

StrongSwan  

View solution in original post

8 REPLIES 8
Benoit_Rech_FTNT

Hello Benson,

this syslog is not related to firewall policy (we can see that is the syslog the policy-id is set to 0) but are generated by the system: * first one: a DNS query haven't received a response * second one: routing issue on SD-WAN, with on path unavailable. There a some filter you can apply on syslog, and also configure filter on event.

#config log syslogd filter

# get severity : information forward-traffic : enable local-traffic : enable multicast-traffic : enable sniffer-traffic : enable anomaly : enable voip : enable gtp : enable filter : filter-type : include

 

and

 # config log eventfilter

 # get event : enable system : enable vpn : enable user : enable router : enable wireless-activity : enable wan-opt : enable endpoint : enable ha : enable security-rating : enable fortiextender : enable connector : enable

 

Best regards, Benoit

emnoc
Esteemed Contributor III

OP

 

Also fortios has log reference  on their website that will give you inside details on log structure

 

e.g

 

https://docs.fortinet.com/document/fortigate/6.2.0/fortios-log-message-reference/656858/log-id-defin...

 

Ken Felix

 

PCNSE 

NSE 

StrongSwan  

BensonLEI

Hi, Benoit,

 

Thanks for your helpful information, questions for the second log event:

1.  It is "WARNING" level, it scares me.

2. The SDWAN zone is created for network traffic, but syslog "Service disabled caused by no outgoing path"; how to identify the root cause and fix it ?

 

Many thanks

 

sw2090
Honored Contributor

looks to me as if the second one caused the first one ;)

 

sd-wan stopped working because of "no outgoing path". Sounds to me as if all wans were down at this time.

In consequence afterwards the DNS request to login.microsoft.com timed out because there was no internet available to resolve that.

 

Oh and Policy #0 exists by default and is the "drop anything that did not match any other policy" one :)


-- 

"It is a mistake to think you can solve any major problems just with potatoes." - Douglas Adams

emnoc
Esteemed Contributor III

I have to disagree the time=stamps are too far apart for those two log events to be even remotely related. The 1st one is surely web-filter or dlp related and  dns-resolution failure.

 

Ken Felix

 

PCNSE 

NSE 

StrongSwan  

BensonLEI

Hi, Guys,

 

Thanks so much for your plenty of information... the first issue ( uID : 5025117 )  is found due to Fortigate DNS setting ( auto internet SLA detection ); hence no concern. 

 

secfnd

Were you able to find resolution to second issue?  I'm dealing w/the same thing

BensonLEI

Hi, secfnd

 

You may check the system log for this issue