FortiGate restarted - how to find the logs

[FG_User_24]

Hi all,

A FortiGate firewall 

Restarted around couple of weeks ago. 

Is it possible to find why it was restarted? 

I know it wasn't done manually and there was no power outage. 

Thanks.

[Toshi_Esumi]

If you are doing only "memory" logging, it's gone when it rebooted. If it's a model with HDD/SSD and you are doing "disk" logging, everything should be still there unless it ran over the capacity. If you are sending log to a "syslog" server or FortiAnalizer outside of the unit, of course it's there.

At least one thing you should check if all logs are gone is "crashlog" with "diag debug crashlog read". There might be a crash dump in it.

Toshi  

[FG_User_24]

Thanks @Toshi_Esumi 

Found that the device is 40F memory only without internal storage and syslog didn't work although configured.

[sjoshi]

Hi,

You can enable comlog if the device supports.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-use-the-COMLog-feature/ta-p/195390

You can also connect to console of the device and when there is a reboot it will collect kernel related logs.

https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-How-to-deal-with-a-kernel-panic/ta-p...