Fortinet black logo

Administration Guide

Home FortiAuthenticator 6.5.2 Administration Guide
6.5.2
6.6.1
6.6.0
6.5.4
6.5.3
6.5.2
6.5.1
6.5.0
6.4.9
6.4.8
6.4.7
6.4.6
6.4.5
6.4.4
6.4.3
6.4.2
6.4.1
6.4.0
6.3.4
6.3.3
6.3.2
6.3.1
6.3.0
6.2.2
6.2.1
6.2.0
6.1.3
6.1.2
6.1.1
6.1.0
6.0.8
6.0.7
6.0.6
6.0.5
6.0.4
6.0.3
6.0.2
6.0.1
6.0.0
5.5.0
5.4.0
5.3.0
5.2.0
5.1.0
5.0.0
4.3.0
4.2.1
4.2.0

Debug logs

Debug logs

Extended debug logs can be accessed by using your web browser to browse to https://<FortiAuthenticator-IP-Address>/debug.

Log Categories

From the tree menu select a log type:

  • RADIUS: Authentication, Accounting, Accounting Monitor, and DNS Updates.

  • TACACS+: General, Authentication, Accounting, and Authorization.

  • Web Server: Apache, WAD, and FastAPI. See FastAPI debug mode.

  • High Availability: Slony, Load Balancing, and Load Balancing HA Sync.

  • Single Sign On: FSSO Agent, FSSO Agent Filtered, and Domain Manager, and Syslog SSO.

  • User Sync: LDAP and SAML.

  • Other: GUI, REST API, LDAP, Windows AD Monitor, SNMP, Disk Monitor, Hardware Monitor, and Kernel.

Note: The CLI Packet Capture (tcpdumpfile) log category is only available when the tcpdumpfile command has been entered using SSH or Telnet, or through the CLI Console if a FortiAuthenticator is installed on a FortiHypervisor. For more information, see CLI commands.

Debug Kit

Select Upload a file to upload a debug kit from your computer.

Note: The option is only available for some log types.

Max. log files size

From the dropdown, select the maximum log file size. You can select up to a maximum of 500 MB. This gives you access to an extended history of debug files.

Note: The option is only available for some log types.

Log level

From the dropdown, select the log severity level.

Enter debug mode

If HA or RADIUS Authentication is selected from the log category, the option to enter the debug mode is available. See RADIUS debugging.

Enter detail debugging mode

You can enter detailed debugging mode if RADIUS Authentication is selected from the log category.

See RADIUS debugging.

Search

Enter a search term in the search field, then select Search to search the debug logs.

Page navigation

Use the First Page, Previous Page, Next Page, and Last Page icons to navigated through the logs.

Show

Select the number of lines to show per page from the dropdown menu. The options are: 100 (default), 250, and 500.

RADIUS debugging

RADIUS authentication debugging mode can be accessed to debug RADIUS authentication issues.

From the Log Categories menu, select RADIUS Authentication and select Enter debug mode from the toolbar.

Enter the username and password and select OK to test the RADIUS authentication and view the authentication response and returned attributes.

Select Enter detail debug mode to enter the detailed debug mode.

Enter the username and password and select OK to test the RADIUS authentication and view the authentication response and returned attributes.

Select Exit debug mode to deactivate the debugging mode.

The following table lists the related CLI commands and GUI elements for RADIUS debugging:

CLI command

Description

GUI

debug radius 0

Put the RADIUS service into normal running mode (only error and system info debug logs).

Exit debug mode

debug radius 1

Put the RADIUS service into debug mode.

Note: debug radius 1 is the normal running mode in 6.4.x and below.

Enter debug mode

debug radius 2

Put the RADIUS service into detailed debug mode.

Note: debug radius 2 is the debug mode in 6.4.x and below.

Enter detail debug mode

After a reboot, the RADIUS service will automatically be in normal running mode (equivalent to debug radius 0).

TCP stack hardening

Configure the number of TCP SYNACK retries for the Linux kernel by accessing:

https://<FortiAuthenticator-IP-Address>/debug/tcp_tuning

From here, enter the number of retries between 1 - 255 (default is 3) and then select Save.

FastAPI debug mode

When FastAPI is selected in Log Categories > Web Server, Enable FastAPI Debug Mode button is available. Clicking Enable FastAPI Debug Mode allows you to record the activity according to the selected options:

Max request amount

The maximum number of requests:

  • 50 (default)

  • 100

  • 150

  • 200

  • 250

Debug run time

The debug run time:

  • 1 Minutes (default)

  • 10 Minutes

  • 1 Hour

  • 2 Hours

  • 4 Hours

  • 6 Hours

  • 1 Day

For example, if the Max request amount is set to 50 and the Debug run time is 1 Minutes, the FortiAuthenticator profiler tool saves the 50 slowest HTTP requests within the next 1 minute.

High level details of the slowest HTTP requests are displayed in the Log Categories > Web Server > FastAPI page.

Once the Debug run time has elapsed, click Download to download a report generated by the profiler tool with additional information.

Previous
Next

Debug logs

Extended debug logs can be accessed by using your web browser to browse to https://<FortiAuthenticator-IP-Address>/debug.

Log Categories

From the tree menu select a log type:

  • RADIUS: Authentication, Accounting, Accounting Monitor, and DNS Updates.

  • TACACS+: General, Authentication, Accounting, and Authorization.

  • Web Server: Apache, WAD, and FastAPI. See FastAPI debug mode.

  • High Availability: Slony, Load Balancing, and Load Balancing HA Sync.

  • Single Sign On: FSSO Agent, FSSO Agent Filtered, and Domain Manager, and Syslog SSO.

  • User Sync: LDAP and SAML.

  • Other: GUI, REST API, LDAP, Windows AD Monitor, SNMP, Disk Monitor, Hardware Monitor, and Kernel.

Note: The CLI Packet Capture (tcpdumpfile) log category is only available when the tcpdumpfile command has been entered using SSH or Telnet, or through the CLI Console if a FortiAuthenticator is installed on a FortiHypervisor. For more information, see CLI commands.

Debug Kit

Select Upload a file to upload a debug kit from your computer.

Note: The option is only available for some log types.

Max. log files size

From the dropdown, select the maximum log file size. You can select up to a maximum of 500 MB. This gives you access to an extended history of debug files.

Note: The option is only available for some log types.

Log level

From the dropdown, select the log severity level.

Enter debug mode

If HA or RADIUS Authentication is selected from the log category, the option to enter the debug mode is available. See RADIUS debugging.

Enter detail debugging mode

You can enter detailed debugging mode if RADIUS Authentication is selected from the log category.

See RADIUS debugging.

Search

Enter a search term in the search field, then select Search to search the debug logs.

Page navigation

Use the First Page, Previous Page, Next Page, and Last Page icons to navigated through the logs.

Show

Select the number of lines to show per page from the dropdown menu. The options are: 100 (default), 250, and 500.

RADIUS debugging

RADIUS authentication debugging mode can be accessed to debug RADIUS authentication issues.

From the Log Categories menu, select RADIUS Authentication and select Enter debug mode from the toolbar.

Enter the username and password and select OK to test the RADIUS authentication and view the authentication response and returned attributes.

Select Enter detail debug mode to enter the detailed debug mode.

Enter the username and password and select OK to test the RADIUS authentication and view the authentication response and returned attributes.

Select Exit debug mode to deactivate the debugging mode.

The following table lists the related CLI commands and GUI elements for RADIUS debugging:

CLI command

Description

GUI

debug radius 0

Put the RADIUS service into normal running mode (only error and system info debug logs).

Exit debug mode

debug radius 1

Put the RADIUS service into debug mode.

Note: debug radius 1 is the normal running mode in 6.4.x and below.

Enter debug mode

debug radius 2

Put the RADIUS service into detailed debug mode.

Note: debug radius 2 is the debug mode in 6.4.x and below.

Enter detail debug mode

After a reboot, the RADIUS service will automatically be in normal running mode (equivalent to debug radius 0).

TCP stack hardening

Configure the number of TCP SYNACK retries for the Linux kernel by accessing:

https://<FortiAuthenticator-IP-Address>/debug/tcp_tuning

From here, enter the number of retries between 1 - 255 (default is 3) and then select Save.

FastAPI debug mode

When FastAPI is selected in Log Categories > Web Server, Enable FastAPI Debug Mode button is available. Clicking Enable FastAPI Debug Mode allows you to record the activity according to the selected options:

Max request amount

The maximum number of requests:

  • 50 (default)

  • 100

  • 150

  • 200

  • 250

Debug run time

The debug run time:

  • 1 Minutes (default)

  • 10 Minutes

  • 1 Hour

  • 2 Hours

  • 4 Hours

  • 6 Hours

  • 1 Day

For example, if the Max request amount is set to 50 and the Debug run time is 1 Minutes, the FortiAuthenticator profiler tool saves the 50 slowest HTTP requests within the next 1 minute.

High level details of the slowest HTTP requests are displayed in the Log Categories > Web Server > FastAPI page.

Once the Debug run time has elapsed, click Download to download a report generated by the profiler tool with additional information.

Previous
Next