Logging, Monitoring, and Troubleshooting
Logging, Monitoring, and Troubleshooting covers where FortiOS records events, how to read them, and which diagnostic tools answer why a packet passed or dropped. Expect questions on log destinations, debug flow, packet capture, and session inspection.
Logging
- Log settings define local disk, memory, FortiAnalyzer, syslog, and WebTrends; each has severity and subtype filters.
- FortiAnalyzer provides aggregation and reports; local logs are limited by disk and roll over.
- Traffic logs record sessions; UTM logs record IPS, antivirus, web filter, and application control events.
- Logging can be enabled per policy; if a policy has logging disabled, a deny may be silent.
- Log severity and log level differ: severity is syslog-like, while level controls verbosity.
Troubleshooting tools
- diagnose debug flow traces policy lookup, routing, NAT, and drop reasons.
- diagnose sniffer packet captures packets on an interface; filters use BPF syntax.
- diagnose sys session list shows session state and NAT; useful for asymmetric or stale sessions.
- get system status, diagnose hardware deviceinfo, and HA status help with platform and cluster issues.
- Use execute log filter to narrow logs before displaying them.
Worked example
Users report that HTTPS to a server fails, but ICMP succeeds. Run a debug flow filtered by the server IP. The output shows route lookup success, policy match, then a drop at the UTM stage with reason blocked by web filter. That means the policy matched but the profile blocked the category. Check the web filter log for the URL and category, and verify whether deep inspection is enabled. ICMP success proves routing and policy allow ICMP, not that the HTTPS policy is identical.
Traps
- Debug flow output is verbose; always filter by source, destination, and port, or the console floods.
- A sniffer capture on the wrong interface misses the traffic; use any interface if unsure.
- Logs may be sent to FortiAnalyzer only; local logs may not show the event.
Key points
- Debug flow shows route lookup, policy match, NAT, and drop reasons.
- Sniffer filters use BPF syntax and require the correct interface.
- UTM logs are separate from traffic logs but can correlate by session.
- Per-policy logging must be enabled for traffic and deny events to appear.
- FortiAnalyzer aggregation may be the only place a full event history exists.