Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
Chris_Worthington
New Contributor

How can I see sessions taking up bandwidth - I don't have a 'diag sys' command

EDIT: Thank you to the person who gave me links to follow (for some reason I can't reply to his proposed solution). The problem is that any command with "diag sys <whatever>" fails because there is no "diag sys" command. The second link did provide some help with the "diag stats" command but I have fewer options than what's listed on the links. Either way, diag status will offer some help. Thanks     I need to see the top sessions taking up bandwidth using CLI. I don't have a "diag sys" command, which seems to be the popular choice. I do have the web interface but it's kind of worthless because it won't let me SORT by connection bandwidth and I have to wade through pages and pages of connections.   Is there another CLI tool that will give me the current bandwidth [strike]hogs[/strike] users?   Here is my system version: FGT60XXXXXXXXXX $ get system status Version: FortiGate-60D v5.2.10,build0742,161129 (GA)   This is what I get if I hit "diag ?": FGT60Dxxxxxxxxxx $ diag antivirus antivirus central-mgmt Central management. debug debug disktest Disk test endpoint Endpoint compliance diagnostics. fdsm FortiCloud/FortiManager Service. firewall Firewall forticare FortiCare Service. forticlient forticlient fortitoken FortiToken hardware hardware ip ip ips ips ipv6 ipv6 lldptx Link Layer Transmission Protocol (LLDP) Transmitter diagnostics. log log netlink netlink npl nplite npu Network Processing Unit settings settings sniffer Sniffer command. spamfilter spamfilter src-vis Source visibility diagnostics. stats Usage statistics. switch-controller fortiswitch controller traffictest Offloading traffic test using internal TX/RX user User vpn vpn wacs Web cache DB daemon. wad WAD diagnostics. wadbd WAN accelerator DB daemon. webfilter webfilter
2 REPLIES 2
emnoc
Esteemed Contributor III

Are running muti-vdoms; If yes   try the diag sys  session command per-vdom, use filters ,etc....

 

http://socpuppet.blogspot.com/2013/06/diag-system-session-quick-way-find.html

 

 

http://socpuppet.blogspot.com/2014/09/exploring-diag-stats-fortigate.html

 

PCNSE 

NSE 

StrongSwan  

PCNSE NSE StrongSwan
Chris_Worthington

Thank you, Emnoc,  for the links to follow. The problem is that any command with "diag sys <whatever>" fails because there is no "diag sys" command. The second link did provide some help with the "diag stats" command but I have fewer options than what's listed on the links. Either way, diag status will offer some help. Thanks  

UPDATE: It looks like I don't have privileged mode/enabled mode access to this FW. But I was able to use diag stats app-bandwidth to get the top 20 apps, then use diag stats app-usage-ip with the app ip from the previous command to get the IP addresses using the most bandwidth. This gives me what I need.

 

If there is a way to match the IP address with the machine name that would be ideal, but I can do that in Linux using the "nbstat" command. 

Labels
Top Kudoed Authors