Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
mhdganji
Contributor

Logging stops and start after restarting

Hi,

On one of my 200E firewalls, after some time, logging to memory does not show anything but after restarting the device it comes up and working. Any way to troubleshoot and solve the problem?

 

Regards,

M. Ganji, Network & Security Expert.
M. Ganji, Network & Security Expert.
1 Solution
Debbie_FTNT

Hey mhdganji,

what firmware version is the affected FortiGate?

As for restarting logging without restarting the whole device, this can usually be achieved by restarting the miglogd service:

#fnsysctl killall miglogd

 

If you are looking to troubleshoot the logging issue, you can also dig into the miglogd debug itself:
#dia de app miglogd -1
#dia de en

+++ Divide by Cucumber Error. Please Reinstall Universe and Reboot +++

View solution in original post

10 REPLIES 10
jhussain_FTNT

When FortiGate is enabled with memory logging, default specific amount of memory space will be allocated for memory logging. Memory logging is not suggested in Lower/middle end firewall,you can configure either Disk or external logging like Fortianalyzer for logging.

warshad
Staff
Staff

Hi,

 

memory logging is not suggested in Lower end firewall, for troubleshooting any specific issue or for monitoring the traffic logs locally, it is possible to enable the memory logging and disable it later.

 

 

Waqas Arshad
Fortinet
jhussain_FTNT

Hi Waqas,

Yes, you can enable the logging for temporarily but it will not store the logs, it will display only the most recent logs entries only.

mhdganji
Contributor

Hi,

I just need it to do some fast troubleshooting but anyway I need it. Is there any daemon or service to bring it back alive without restarting the device? And my main question still on the table: why it happens just to this device among many ones?

 

regards

M. Ganji, Network & Security Expert.
M. Ganji, Network & Security Expert.
Debbie_FTNT

Hey mhdganji,

what firmware version is the affected FortiGate?

As for restarting logging without restarting the whole device, this can usually be achieved by restarting the miglogd service:

#fnsysctl killall miglogd

 

If you are looking to troubleshoot the logging issue, you can also dig into the miglogd debug itself:
#dia de app miglogd -1
#dia de en

+++ Divide by Cucumber Error. Please Reinstall Universe and Reboot +++
mhdganji

"fnsysctl killall miglogd"   did the trick. The command is not predicted while typing and I was looking for it more than 30 minutes :)

The O.S. is 6.4.5. Maybe I should update it to resolve the problem.

M. Ganji, Network & Security Expert.
M. Ganji, Network & Security Expert.
Debbie_FTNT

Happy I was able to help at least a bit :).

As for your FortiGate in 6.4.5 version - there was an older bug in 6.0 versions where logging would randomly stop after a few days, but 6.4.5 is not affected by this. I did have a poke through our bug database, but couldn't find anything logging-related that matches what you described so far, so I'm not sure what's going on.

I would suggest you open a ticket with FortiGate Technical Support for further investigation.

+++ Divide by Cucumber Error. Please Reinstall Universe and Reboot +++
mhdganji
Contributor

Hi,

Even after updating to 7.0.6 the problem still is there.

After fnsysctl killall miglogd the logs are displayed for a while but again they vanish.

 

This is the log of miglogd. Any hint from this log to find out the problem?

 

Logs.JPG

M. Ganji, Network & Security Expert.
M. Ganji, Network & Security Expert.
Debbie_FTNT

Hey mhdganji,

the output looks fine to me - a technical ticket is probably the best way to go here, to really dig into debug and figure out what may be happening.

Sorry to hear the issue is not resolved.

+++ Divide by Cucumber Error. Please Reinstall Universe and Reboot +++
Top Kudoed Authors