Events and Issues on Fortigate Firewall

[marcog86]

Hi Guys

Happy new year.

This morning I found fortigate blocked (fortigate 300E), it's in HA mode Active Active. Firewall was reachable but all the traffic was locked because ( i think)  there was an overlaod of memory 88% (i think RAM memory). The faster solution was been to restart device via cli.

Now the backup fortigate is running as master and memory is running on 46%

I looking for any issue or any details about this block via web interface but I didn't find anything. I don't know if it's necessary to implement any config.

I noted an issue:

I configured syslog server via cli and I enabled only warning severity and lower 1 mounth ago.

On Syslog server I don't find any log over 29/12/21 at 14:47 o'clock.

After reboot syslog server restart to receive logs from Fortigate, from logs I don't find anything.

On fortigate I disabled save of logs on local memory, is it correct?

Where I can looking for the issue? Is there any cli command to looking for the issue?

I know it's general request but I don't know how I can start.

Marco

[AlexC-FTNT]

There are 3 places to look:

- system event logs

- crashlog (may be cleared at reboot or if memory logging disabled) 

https://community.fortinet.com/t5/FortiGate/Technical-Note-How-to-clear-the-crash-log/ta-p/198082?ex...

- comlog (if it was enabled)
https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-use-COMLog-feature/ta-p/195390?exte...

If you can't find it in these places, you won't be able to find out.