Diag Debug and Sniffer

[rb400]

Are there any commands to easily reveal what diagnose commands are enabled and/or active?

Part 2:  Will all diag commands be disabled (inactive) upon FGT reboot?

Part 3: Expanded question:

(global) # diag debug info debug output:           disable console timestamp:      disable console no user log message:    disable zebos debug level:      306783954 (0x124926d2)   <<??? CLI debug level:        3 (global) # diag debug reset (global) # diag debug info debug output:           disable console timestamp:      disable console no user log message:    disable CLI debug level:        3

What does "zebos debug level:      306783954 (0x124926d2)"   mean?  Obviously, it disappeared after I used the reset command.

Part 4:

Is the following syntax correct?

(root) # diag sniff packet any 'host 10.19.1.231 and port80 and port 443' 1

If so, when 10.19.1.231 tries to access any web page via http will the sniff catch the packets?

BTW: (root) # diag sniff packet any 'host 10.19.1.231 and icmp' 1 << did catch packets

[Robin_Svanberg · Accepted solution]

RB400 wrote:

Are there any commands to easily reveal what diagnose commands are enabled and/or active?

Part 2:  Will all diag commands be disabled (inactive) upon FGT reboot?

Hi,

"diag debug info" will show the debugging levels.

All diag commands will be reset upon reboot, or manually by running "diag debug reset".

BR Robin

[Robin_Svanberg · Accepted solution]

RB400 wrote:

Robin Svanberg wrote:
...All diag commands will be reset upon reboot, or manually by running "diag debug reset".

I checked the Fortinet KB, documentation, and this forum.

Is there any FGT complete guide or cookbook for DIAG concepts and use?

Thanks for your reply...a very big help !!

Check out the http://help.fortinet.com/fos50hlp/52data/index.htm#FortiOS/fortigate-toubleshooting-52/troubleshooti... (You will find a lot of other useful information at this site :))

Link to all Fortigate docs -> http://docs.fortinet.com/fortigate/admin-guides

"Debug output provides continuous, real-time event information. Debugging output continues until it is explicitly stopped or until the unit is rebooted. Debugging output can affect system performance and will be continually generated even though output might not be displayed in the CLI console."

BR Robin

[Robin_Svanberg · Accepted solution]

RB400 wrote:

Are there any commands to easily reveal what diagnose commands are enabled and/or active?

Part 2:  Will all diag commands be disabled (inactive) upon FGT reboot?

Hi,

"diag debug info" will show the debugging levels.

All diag commands will be reset upon reboot, or manually by running "diag debug reset".

BR Robin

[rb400]

Robin Svanberg wrote:
...All diag commands will be reset upon reboot, or manually by running "diag debug reset".

I checked the Fortinet KB, documentation, and this forum.

Is there any FGT complete guide or cookbook for DIAG concepts and use?

Thanks for your reply...a very big help !!

[Robin_Svanberg · Accepted solution]

RB400 wrote:

Robin Svanberg wrote:
...All diag commands will be reset upon reboot, or manually by running "diag debug reset".

I checked the Fortinet KB, documentation, and this forum.

Is there any FGT complete guide or cookbook for DIAG concepts and use?

Thanks for your reply...a very big help !!

Check out the http://help.fortinet.com/fos50hlp/52data/index.htm#FortiOS/fortigate-toubleshooting-52/troubleshooti... (You will find a lot of other useful information at this site :))

Link to all Fortigate docs -> http://docs.fortinet.com/fortigate/admin-guides

"Debug output provides continuous, real-time event information. Debugging output continues until it is explicitly stopped or until the unit is rebooted. Debugging output can affect system performance and will be continually generated even though output might not be displayed in the CLI console."

BR Robin

[Robin_Svanberg]

RB400 wrote:

Are there any commands to easily reveal what diagnose commands are enabled and/or active?

Part 2:  Will all diag commands be disabled (inactive) upon FGT reboot?

Part 3: Expanded question:

(global) # diag debug info debug output:           disable console timestamp:      disable console no user log message:    disable zebos debug level:      306783954 (0x124926d2)   <<??? CLI debug level:        3 (global) # diag debug reset (global) # diag debug info debug output:           disable console timestamp:      disable console no user log message:    disable CLI debug level:        3

What does "zebos debug level:      306783954 (0x124926d2)"   mean?  Obviously, it disappeared after I used the reset command.

I´m not 100% sure, but I think Zebos is the routing engine, and if you enable a diag debug flow the zebos debug level will be set.

Anyone that can confirm this?

BR Robin

[neonbit · Accepted solution]

There's a diagnostic wiki page now available that has quite a few diagnose commands and the debug levels you should be running them at. It can be found here: http://wiki.diagnose.fort...com/index.php/Overview