May I know the cause of ha not sync?

[Coworksit1]

Hello.

I have a question about Ha being out of sync.

Added user objects and groups to the portgate.

Immediately after that, it was not synchronized.

I deleted the object I created after HA was out of sync and it was resynchronized normally.

As before, when you create a user object on the master equipment and then use the Run ha Sync Start command to add/delete the user object, the synchronization was not broken.

Does anyone know why HA doesn't sync when creating objects?

If anyone knows about this issue, I would appreciate it if you could let me know the cause and how to respond.

[Toshi_Esumi]

How did you check it was out-of-sync? If GUI, it might take a while to reflect the status change.
You need to keep running
    diag debug app hasync -1
    diag debug app hasync -1

in a CLI window on both units when you make the changes on the primary side.
Then run..
    diag sys ha checksum recalculate
on both units after the change. And then keep checking...
    get sys ha status
    diag sys ha checksum cluster [ | grep all: <if you have too many vdoms>]

If you do this with a handful of changes, you can understand/sense/feel what's going on and what's not happening.

All of these should be described in this KB.
https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-How-to-troubleshoot-HA-synchronizati...

Toshi

[Coworksit1]

Hello

Thank you for your response.

1. How did you check it was out-of-sync?
- I checked it in the GUI. It came out like the screen below. (Example)

2. If GUI, it might take a while to reflect the status change.

- So does the cause of haout of sync occur sometimes when GUI setting reflection is slow?

- In this case, should I use the execute ha synchronize start command to resolve it?
(If it doesn't work out, we will report the URL attached to the reply.)

Thank you

[Toshi_Esumi · Accepted solution]

It should be copied over right way. But your screen's refresh might take time. You never need to run "exe ha sync start" unless you intentionally run "exe ha sync stop". 
Again, if you keep watching at the output of "diag debug app" and keep checking the checksum differences, you would know exactly when it was copied and how slow/fast the GUI might be. Just don't rely on GUI to determine what's going on in HA operation.

Once it got stuck and the copy doesn't seem to happen any more, you can use the GUI to see what table is mismatching, which is much easier than CLI.

Toshi

[Toshi_Esumi]

It should be in the KB but don't forget:
    diag debug enable
after those "diag debug app" commands, unless you're doing these through the console port.

Toshi