How to check the logs
This step in troubleshooting can be forgotten, but its an important one. Logging records the traffic passing through the FortiGate unit to your network and what action the FortiGate unit took during its scanning process of the traffic. This recorded information is called a log message.
When you configure FortiOS initially, log as much information as you can. If needed, logging of unused features can be turned off or scaled back if the logs generated are too large.
As with most troubleshooting steps, before you can determine if the logs indicate a problem, you need to know what logs result from normal operation. Without a baseline it is difficult to properly troubleshoot.
When troubleshooting with log files:
- Compare current logs to a recorded baseline of normal operation.
- If needed increase the level of logging (such as from Warning to Information) to obtain more information.
When increasing logging levels, ensure that alert email is configured and both disk usage and log quota are selected. This ensures you will be notified if the increased logging causes problems. You can also use Logging Monitor (located in Log&Report > Monitor > Logging volume Monitor) to determine the activities that generate the most log entries.
- check all logs to ensure important information is not overlooked
- filter or order log entries based on different fields (such as level, service, or IP address) to look for patterns that may indicate a specific problem (such as frequent blocked connections on a specific port for all IP addresses)
Logs will help identify and locate any problems, but they will not solve the problems. The job of logs is to speed up your problem solving and save you time and effort.
For more information on Logging and Log Reports, see the Logging and Reporting handbook chapter.