fortigate slave disk error can make master high cpu ?

[ntluan56]

Hello everyone,

We are facing a weird situation.

With 1500D HA cluster (active-pasive),  yesterday slave had below messages:

     XT2-fs (sda3): previous I/O error to superblock detected
     Cannot open /daEXT2-fs (sda3): previous I/O error to superblock detected
     ta2/geodb/geoip.EXT2-fs (sda3): previous I/O error to superblock detected
     4. Error=Input/oEXT2-fs (sda3): previous I/O error to superblock detected

     ....

Some services were afftected.

• Can't see any log when access to slave from GUI
• Can't get snmp data from mgmt port of master sometimes, seem like high cpu happened.
• IPsec multiple sites are not connected (Ping, remote desktop, file sharing, etc.) However, SSL-VPN can be connected and operated
• After we shutdown slave, everything went ok

I am wondering, a disk/partion failed on slave can affect master performance. 

Is there any information about this case ? 

Thank you. 

[gfleming · Accepted solution]

This sounds like something you should be talking to TAC about to be honest.

[gfleming · Accepted solution]

This sounds like something you should be talking to TAC about to be honest.

[ntluan56]

We have replaced the slave and also rebuilt the HA cluster. Everything is fine.

The fact that our system is still running on 6.2.x firmware and doesn't even have basic log monitoring is concerning.

It's necessary to monitor logs in real-time and take immediate action, even on the slave side.

Thank you!

[gfleming · Accepted solution]

Sorry what's your concern about not having basic log monitoring? What are you looking for exactly?

This might be relevant? https://docs.fortinet.com/document/fortigate/6.2.12/cookbook/313152/out-of-band-management-with-rese...

Also what's more concerning about running 6.2 is the fact that it's been EOES for almost a year and goes EOS in about half a year. You should look at upgrading pretty soon...

[ntluan56]

This is regarding our trouble with log monitoring, not with Fortigate. We monitor through HA-manage-interfaces using SNMP.
Thank you for your suggestion.
I have just joined this company. The system is very outdated and the company does not want to make many changes, which is quite disappointing.