1.6 System Logging, Diagnostics & Troubleshooting Tools

System Logging, Diagnostics & Troubleshooting Tools

Effective network security administration and incident response depend on comprehensive event logging and real-time command-line diagnostic capabilities. FortiOS 7.6 provides a sophisticated logging framework alongside granular CLI troubleshooting tools that allow administrators to inspect packet flows, diagnose session drop causes, monitor SPU/CPU performance, and trace control plane protocols.

---

FortiOS Logging Architecture & Event Classifications

FortiOS organizes log messages into a structured hierarchy divided into three main Log Types:

1. Traffic Logs

Record network session connection events traversing the firewall.

• Forward Traffic Logs: Sessions allowed or denied by IPv4/IPv6 firewall policies.
• Local Traffic Logs: Administrative management traffic terminating on or originating from FortiGate interfaces (e.g., HTTPS GUI, SSH, PING).
• Multicast / Violation Logs: Traffic matching multicast policies or dropped due to network protocol violations.

2. Event Logs

Record system operational events, configuration changes, and administrative actions.

• System Events: Administrator logins, interface status changes, HA failovers, firmware upgrades, and resource alerts.
• User / Router / VPN Events: Authentication events, dynamic routing neighbor state changes, and IPsec/SSL VPN tunnel status.

3. Security Logs

Record events generated by FortiOS Security Profiles during content inspection.

• Contains detailed alerts from Antivirus, Intrusion Prevention System (IPS), Web Filter, Application Control, DNS Filter, File Filter, and DLP.

---

Log Severity Levels

Every log entry in FortiOS is tagged with an official Syslog-compliant Severity Level ranging numerically from 0 to 7.

---

Remote Log Storage Destinations

To prevent flash storage degradation and satisfy regulatory compliance retention mandates, logs should be forwarded to remote collectors:

# Configuring central FortiAnalyzer logging destination via CLI
config log fortianalyzer setting
    set status enable
    set server 10.10.10.100
    set mode real-time
    set enc-algorithm high
    set upload-option real-time
end

---

Packet Sniffing: diagnose sniffer packet

FortiOS includes an on-box packet capture tool analogous to tcpdump. It captures packets passing through network interfaces at Layer 2/3.

Syntax

diagnose sniffer packet <interface> '<pcap_filter>' <verbose_level> <count> <timestamp>

Verbose Output Levels

• Level 1: Print header of packets (Src IP, Dst IP, Ports, TCP flags).
• Level 2: Print header and packet payload data in hex format.
• Level 3: Print header and packet payload data in hex and ASCII format.
• Level 4: Print interface name and header of packets.
• Level 5: Print interface name, header, and packet payload in hex/ASCII.
• Level 6: Print interface name, header, payload in hex/ASCII, and absolute timestamp.

Practical Sniffer Commands

# Capture 10 packets on any interface matching destination IP 192.168.1.50 and HTTP port 80 with timestamps
diagnose sniffer packet any 'host 192.168.1.50 and port 80' 6 10 a

# Capture ICMP ping packets traversing port1
diagnose sniffer packet port1 'icmp' 4 20 l

---

Stateful Session Table Inspection

The FortiOS kernel maintains a stateful session table tracking active TCP, UDP, and ICMP connections. Inspecting active sessions is essential for diagnosing NAT issues, policy drops, and routing mismatches.

Filtering and Inspecting Sessions

# Step 1: Clear existing filters and define source IP filter
diagnose sys session filter clear
diagnose sys session filter src 10.0.1.100
diagnose sys session filter dport 443

# Step 2: Print filtered active session list details
diagnose sys session list

# Step 3: Clear all sessions matching current filter (Use with caution!)
diagnose sys session clear

---

Packet Flow Tracing: diagnose debug flow

When a packet is dropped unexpectedly, diagnose debug flow reveals the internal step-by-step decision processing of the FortiOS kernel—including policy matching, route lookups, NAT transformations, and Security Profile evaluations.

Execution Sequence

# Step 1: Reset debug filters and define target IP filter
diagnose debug reset
diagnose debug flow filter addr 192.168.1.100
diagnose debug flow filter port 443

# Step 2: Enable console display output and set trace packet count limit
diagnose debug flow show console enable
diagnose debug flow trace start 10

# Step 3: Enable global debug engine
diagnose debug enable

# Step 4: After capturing output, disable debug engine
diagnose debug disable

---

Core System Status & Network Diagnostics

# Test network reachability from specific source interface IP
execute ping-options source 10.0.1.99
execute ping 8.8.8.8

# Trace network hop paths to target IP
execute traceroute 1.1.1.1

# Display global performance status (CPU, Memory, Session creation rate)
get system performance status

---

FortiOS Diagnostic & Troubleshooting Command Matrix