Fortinet white logo
Fortinet docs logo DOCUMENT LIBRARY
Fortinet white logo
Fortinet docs logo DOCUMENT LIBRARY
Products Best Practices Hardware Guides Products A-Z
Summary
By Solution
By 4D Pillars
By Cloud
Secure Networking
Unified SASE
Security Operations
Secure SD-WAN
Secure Access Service Edge (SASE)
ZTNA
LAN Edge
Identity and Access Management
Next Generation Firewall
Public Cloud
Private Cloud
FortiCloud
Secure Networking
  • Hybrid Mesh Firewall
  • NOC Management
  • LAN
  • WAN
    • More >>
    Unified SASE
  • Single Vendor SASE
  • Cloud Network Security
  • Secure Endpoint Connectivity
  • Web Application / API Protection
    • More >>
    Security Operations
  • Security Operations Automation
  • Identity
  • Early Detection & Prevention
    • More >>
    Secure Networking
  • Hybrid Mesh Firewall
  • NOC Management
  • LAN
  • WAN
  • Communication & Surveillance
    • Unified SASE
  • Single Vendor SASE
  • Secure Endpoint Connectivity
  • Cloud Network Security
  • Cloud-Native Security
  • Web Application / API Protection
    • Security Operations
  • Security Operations Automation
  • Endpoint
  • Data Protection
  • Identity
  • Email
  • Early Detection & Prevention
  • Expert Services
  • Edge Firewall
  • Orchestration & management
  • SD Branch
  • Application Delivery
  • Single Vendor SASE
  • Secure Endpoint Connectivity
  • Secure Private Access
  • Thin Edge
  • Identity
  • Application Gateway
  • Enterprise Asset Management
  • Endpoint Agent
  • Agentless Security Posture
  • Identity
  • Wireless
  • Switching
  • Identity
  • Privilege Acccess Management
  • Next Generation Firewall
  • Orchestration & management
  • Expert Services
  • All
  • All
  • Account Management
  • SAAS Management
  • SAAS Application Security
  • Managed Services
  • Platform as a service (PAAS)
  • Other SAAS Services
    • 4D Resources
    Solution Hubs
  • 4D Pillars
  • Cloud
  • Popular Solutions

    • Cookbook

    6.2.14
    6.2.16
    6.2.15
    6.2.14
    6.2.13
    6.2.12
    6.2.11
    6.2.10
    6.2.9
    6.2.8
    6.2.7
    6.2.6
    6.2.5
    6.2.4
    6.2.3
    6.2.2
    6.2.0
    6.0.0
    5.6.0
    5.4.0

    Understanding SD-WAN related logs

    Understanding SD-WAN related logs

    This topic lists the SD-WAN related logs and explains when the logs will be triggered.

    Health-check detects a failure:
    • When health-check detects a failure, it will record a log:
      34: date=2019-03-23 time=17:26:06 logid="0100022921" type="event" subtype="system" level="critical" vd="root" eventtime=1553387165 logdesc="Routing information changed" name="test" interface="R150" status="down" msg="Static route on interface R150 may be removed by health-check test. Route:  (10.100.1.2->10.100.2.22 ping-down)"
    • When health-check detects a recovery, it will record a log:
      32: date=2019-03-23 time=17:26:54 logid="0100022921" type="event" subtype="system" level="critical" vd="root" eventtime=1553387214 logdesc="Routing information changed" name="test" interface="R150" status="up" msg="Static route on interface R150 may be added by health-check test. Route:  (10.100.1.2->10.100.2.22 ping-up)"
    Health-check has an SLA target and detects SLA qualification changes:
    • When health-check has an SLA target and detects SLA changes, and changes to fail:
      5: date=2019-04-11 time=11:48:39 logid="0100022923" type="event" subtype="system" level="notice" vd="root" eventtime=1555008519816639290 logdesc="Virtual WAN Link status" msg="SD-WAN Health Check(ping) SLA(1): number of pass members changes from 2 to 1."
    • When health-check has an SLA target and detects SLA changes, and changes to pass:
      2: date=2019-04-11 time=11:49:46 logid="0100022923" type="event" subtype="system" level="notice" vd="root" eventtime=1555008586149038471 logdesc="Virtual WAN Link status" msg="SD-WAN Health Check(ping) SLA(1): number of pass members changes from 1 to 2."
    SD-WAN calculates a link's session/bandwidth over/under its ratio and stops/resumes traffic:
    • When SD-WAN calculates a link's session/bandwidth over its configured ratio and stops forwarding traffic:
      3: date=2019-04-10 time=17:15:40 logid="0100022924" type="event" subtype="system" level="notice" vd="root" eventtime=1554941740185866628 logdesc="Virtual WAN Link volume status" interface="R160" msg="The member(3) enters into conservative status with limited ablity to receive new sessions for too much traffic."
    • When SD-WAN calculates a link's session/bandwidth according to its ratio and resumes forwarding traffic:
      1: date=2019-04-10 time=17:20:39 logid="0100022924" type="event" subtype="system" level="notice" vd="root" eventtime=1554942040196041728 logdesc="Virtual WAN Link volume status" interface="R160" msg="The member(3) resume normal status to receive new sessions for internal adjustment."
    The SLA mode service rule's SLA qualified member changes:
    • When the SLA mode service rule's SLA qualified member changes. In this example R150 fails the SLA check, but is still alive:
      14: date=2019-03-23 time=17:44:12 logid="0100022923" type="event" subtype="system" level="notice" vd="root" eventtime=1553388252 logdesc="Virtual WAN Link status" msg="Service2() prioritized by SLA will be redirected in seq-num order 2(R160) 1(R150)."
15: date=2019-03-23 time=17:44:12 logid="0100022923" type="event" subtype="system" level="notice" vd="root" eventtime=1553388252 logdesc="Virtual WAN Link status" interface="R150" msg="The member1(R150) SLA order changed from 1 to 2. "
16: date=2019-03-23 time=17:44:12 logid="0100022923" type="event" subtype="system" level="notice" vd="root" eventtime=1553388252 logdesc="Virtual WAN Link status" interface="R160" msg="The member2(R160) SLA order changed from 2 to 1. "
    • When the SLA mode service rule's SLA qualified member changes. In this example R150 changes from fail to pass:
      1: date=2019-03-23 time=17:46:05 logid="0100022923" type="event" subtype="system" level="notice" vd="root" eventtime=1553388365 logdesc="Virtual WAN Link status" msg="Service2() prioritized by SLA will be redirected in seq-num order 1(R150) 2(R160)."
2: date=2019-03-23 time=17:46:05 logid="0100022923" type="event" subtype="system" level="notice" vd="root" eventtime=1553388365 logdesc="Virtual WAN Link status" interface="R160" msg="The member2(R160) SLA order changed from 1 to 2. "
3: date=2019-03-23 time=17:46:05 logid="0100022923" type="event" subtype="system" level="notice" vd="root" eventtime=1553388365 logdesc="Virtual WAN Link status" interface="R150" msg="The member1(R150) SLA order changed from 2 to 1. "
    The priority mode service rule member's link status changes:
    • When priority mode service rule member's link status changes. In this example R150 changes to better than R160, and both are still alive:
      1: date=2019-03-23 time=17:33:23 logid="0100022923" type="event" subtype="system" level="notice" vd="root" eventtime=1553387603 logdesc="Virtual WAN Link status" msg="Service2() prioritized by packet-loss will be redirected in seq-num order 1(R150) 2(R160)."
2: date=2019-03-23 time=17:33:23 logid="0100022923" type="event" subtype="system" level="notice" vd="root" eventtime=1553387603 logdesc="Virtual WAN Link status" interface="R160" msg="The member2(R160) link quality packet-loss order changed from 1 to 2. "
3: date=2019-03-23 time=17:33:23 logid="0100022923" type="event" subtype="system" level="notice" vd="root" eventtime=1553387603 logdesc="Virtual WAN Link status" interface="R150" msg="The member1(R150) link quality packet-loss order changed from 2 to 1. "
    • When priority mode service rule member's link status changes. In this example R160 changes to better than R150, and both are still alive:
      6: date=2019-03-23 time=17:32:01 logid="0100022923" type="event" subtype="system" level="notice" vd="root" eventtime=1553387520 logdesc="Virtual WAN Link status" msg="Service2() prioritized by packet-loss will be redirected in seq-num order 2(R160) 1(R150)."
7: date=2019-03-23 time=17:32:01 logid="0100022923" type="event" subtype="system" level="notice" vd="root" eventtime=1553387520 logdesc="Virtual WAN Link status" interface="R150" msg="The member1(R150) link quality packet-loss order changed from 1 to 2. "
8: date=2019-03-23 time=17:32:01 logid="0100022923" type="event" subtype="system" level="notice" vd="root" eventtime=1553387520 logdesc="Virtual WAN Link status" interface="R160" msg="The member2(R160) link quality packet-loss order changed from 2 to 1. "
    SD-WAN member is used in service and it fails the health-check:
    • When SD-WAN member fails the health-check, it will stop forwarding traffic:
      6: date=2019-04-11 time=13:33:21 logid="0100022923" type="event" subtype="system" level="notice" vd="root" eventtime=1555014801844089814 logdesc="Virtual WAN Link status" interface="R160" msg="The member2(R160) link is unreachable or miss threshold. Stop forwarding traffic. "
    • When SD-WAN member passes the health-check again, it will resume forwarding logs:
      2: date=2019-04-11 time=13:33:36 logid="0100022923" type="event" subtype="system" level="notice" vd="root" eventtime=1555014815914643626 logdesc="Virtual WAN Link status" interface="R160" msg="The member2(R160) link is available. Start forwarding traffic. "
    Load-balance mode service rule's SLA qualified member changes:
    • When load-balance mode service rule's SLA qualified member changes. In this example R150 changes to not meet SLA:
      2: date=2019-04-11 time=14:11:16 logid="0100022923" type="event" subtype="system" level="notice" vd="root" eventtime=1555017075926510687 logdesc="Virtual WAN Link status" msg="Service1(rule2) will be load balanced among members  2(R160) with available routing."
3: date=2019-04-11 time=14:11:16 logid="0100022923" type="event" subtype="system" level="notice" vd="root" eventtime=1555017075926508676 logdesc="Virtual WAN Link status" interface="R150" msg="The member1(R150) SLA order changed from 1 to 2. "
4: date=2019-04-11 time=14:11:16 logid="0100022923" type="event" subtype="system" level="notice" vd="root" eventtime=1555017075926507182 logdesc="Virtual WAN Link status" interface="R160" msg="The member2(R160) SLA order changed from 2 to 1. "
    • When load-balance mode service rule's SLA qualified member changes. In this example R150 changes to meet SLA:
      1: date=2019-04-11 time=14:33:23 logid="0100022923" type="event" subtype="system" level="notice" vd="root" eventtime=1555017075926510668 logdesc="Virtual WAN Link status" msg="Service1(rule2) will be load balanced among members 1(R150) 2(R160) with available routing."
2: date=2019-03-23 time=14:33:23 logid="0100022923" type="event" subtype="system" level="notice" vd="root" eventtime=1553387603592651068 logdesc="Virtual WAN Link status" interface="R160" msg="The member2(R160) link quality packet-loss order changed from 1 to 2. "
3: date=2019-03-23 time=14:33:23 logid="0100022923" type="event" subtype="system" level="notice" vd="root" eventtime=1553387603592651068 logdesc="Virtual WAN Link status" interface="R150" msg="The member1(R150) link quality packet-loss order changed from 2 to 1. "
    SLA link status logs, generated with interval sla-fail-log-period or sla-pass-log-period:
    • When SLA fails, SLA link status logs will be generated with interval sla-fail-log-period:
      7: date=2019-03-23 time=17:45:54 logid="0100022925" type="event" subtype="system" level="notice" vd="root" eventtime=1553388352 logdesc="Link monitor SLA information" name="test" interface="R150" status="up" msg="Latency: 0.016, jitter: 0.002, packet loss: 21.000%, inbandwidth: 0Mbps, outbandwidth: 200Mbps, bibandwidth: 200Mbps, sla_map: 0x0"
    • When SLA passes, SLA link status logs will be generated with interval sla-pass-log-period:
      5: date=2019-03-23 time=17:46:05 logid="0100022925" type="event" subtype="system" level="information" vd="root" eventtime=1553388363 logdesc="Link monitor SLA information" name="test" interface="R150" status="up" msg="Latency: 0.017, jitter: 0.003, packet loss: 0.000%, inbandwidth: 0Mbps, outbandwidth: 200Mbps, bibandwidth: 200Mbps, sla_map: 0x1"
    Previous
    Next

    Understanding SD-WAN related logs

    Understanding SD-WAN related logs

    This topic lists the SD-WAN related logs and explains when the logs will be triggered.

    Health-check detects a failure:
    • When health-check detects a failure, it will record a log:
      34: date=2019-03-23 time=17:26:06 logid="0100022921" type="event" subtype="system" level="critical" vd="root" eventtime=1553387165 logdesc="Routing information changed" name="test" interface="R150" status="down" msg="Static route on interface R150 may be removed by health-check test. Route:  (10.100.1.2->10.100.2.22 ping-down)"
    • When health-check detects a recovery, it will record a log:
      32: date=2019-03-23 time=17:26:54 logid="0100022921" type="event" subtype="system" level="critical" vd="root" eventtime=1553387214 logdesc="Routing information changed" name="test" interface="R150" status="up" msg="Static route on interface R150 may be added by health-check test. Route:  (10.100.1.2->10.100.2.22 ping-up)"
    Health-check has an SLA target and detects SLA qualification changes:
    • When health-check has an SLA target and detects SLA changes, and changes to fail:
      5: date=2019-04-11 time=11:48:39 logid="0100022923" type="event" subtype="system" level="notice" vd="root" eventtime=1555008519816639290 logdesc="Virtual WAN Link status" msg="SD-WAN Health Check(ping) SLA(1): number of pass members changes from 2 to 1."
    • When health-check has an SLA target and detects SLA changes, and changes to pass:
      2: date=2019-04-11 time=11:49:46 logid="0100022923" type="event" subtype="system" level="notice" vd="root" eventtime=1555008586149038471 logdesc="Virtual WAN Link status" msg="SD-WAN Health Check(ping) SLA(1): number of pass members changes from 1 to 2."
    SD-WAN calculates a link's session/bandwidth over/under its ratio and stops/resumes traffic:
    • When SD-WAN calculates a link's session/bandwidth over its configured ratio and stops forwarding traffic:
      3: date=2019-04-10 time=17:15:40 logid="0100022924" type="event" subtype="system" level="notice" vd="root" eventtime=1554941740185866628 logdesc="Virtual WAN Link volume status" interface="R160" msg="The member(3) enters into conservative status with limited ablity to receive new sessions for too much traffic."
    • When SD-WAN calculates a link's session/bandwidth according to its ratio and resumes forwarding traffic:
      1: date=2019-04-10 time=17:20:39 logid="0100022924" type="event" subtype="system" level="notice" vd="root" eventtime=1554942040196041728 logdesc="Virtual WAN Link volume status" interface="R160" msg="The member(3) resume normal status to receive new sessions for internal adjustment."
    The SLA mode service rule's SLA qualified member changes:
    • When the SLA mode service rule's SLA qualified member changes. In this example R150 fails the SLA check, but is still alive:
      14: date=2019-03-23 time=17:44:12 logid="0100022923" type="event" subtype="system" level="notice" vd="root" eventtime=1553388252 logdesc="Virtual WAN Link status" msg="Service2() prioritized by SLA will be redirected in seq-num order 2(R160) 1(R150)."
15: date=2019-03-23 time=17:44:12 logid="0100022923" type="event" subtype="system" level="notice" vd="root" eventtime=1553388252 logdesc="Virtual WAN Link status" interface="R150" msg="The member1(R150) SLA order changed from 1 to 2. "
16: date=2019-03-23 time=17:44:12 logid="0100022923" type="event" subtype="system" level="notice" vd="root" eventtime=1553388252 logdesc="Virtual WAN Link status" interface="R160" msg="The member2(R160) SLA order changed from 2 to 1. "
    • When the SLA mode service rule's SLA qualified member changes. In this example R150 changes from fail to pass:
      1: date=2019-03-23 time=17:46:05 logid="0100022923" type="event" subtype="system" level="notice" vd="root" eventtime=1553388365 logdesc="Virtual WAN Link status" msg="Service2() prioritized by SLA will be redirected in seq-num order 1(R150) 2(R160)."
2: date=2019-03-23 time=17:46:05 logid="0100022923" type="event" subtype="system" level="notice" vd="root" eventtime=1553388365 logdesc="Virtual WAN Link status" interface="R160" msg="The member2(R160) SLA order changed from 1 to 2. "
3: date=2019-03-23 time=17:46:05 logid="0100022923" type="event" subtype="system" level="notice" vd="root" eventtime=1553388365 logdesc="Virtual WAN Link status" interface="R150" msg="The member1(R150) SLA order changed from 2 to 1. "
    The priority mode service rule member's link status changes:
    • When priority mode service rule member's link status changes. In this example R150 changes to better than R160, and both are still alive:
      1: date=2019-03-23 time=17:33:23 logid="0100022923" type="event" subtype="system" level="notice" vd="root" eventtime=1553387603 logdesc="Virtual WAN Link status" msg="Service2() prioritized by packet-loss will be redirected in seq-num order 1(R150) 2(R160)."
2: date=2019-03-23 time=17:33:23 logid="0100022923" type="event" subtype="system" level="notice" vd="root" eventtime=1553387603 logdesc="Virtual WAN Link status" interface="R160" msg="The member2(R160) link quality packet-loss order changed from 1 to 2. "
3: date=2019-03-23 time=17:33:23 logid="0100022923" type="event" subtype="system" level="notice" vd="root" eventtime=1553387603 logdesc="Virtual WAN Link status" interface="R150" msg="The member1(R150) link quality packet-loss order changed from 2 to 1. "
    • When priority mode service rule member's link status changes. In this example R160 changes to better than R150, and both are still alive:
      6: date=2019-03-23 time=17:32:01 logid="0100022923" type="event" subtype="system" level="notice" vd="root" eventtime=1553387520 logdesc="Virtual WAN Link status" msg="Service2() prioritized by packet-loss will be redirected in seq-num order 2(R160) 1(R150)."
7: date=2019-03-23 time=17:32:01 logid="0100022923" type="event" subtype="system" level="notice" vd="root" eventtime=1553387520 logdesc="Virtual WAN Link status" interface="R150" msg="The member1(R150) link quality packet-loss order changed from 1 to 2. "
8: date=2019-03-23 time=17:32:01 logid="0100022923" type="event" subtype="system" level="notice" vd="root" eventtime=1553387520 logdesc="Virtual WAN Link status" interface="R160" msg="The member2(R160) link quality packet-loss order changed from 2 to 1. "
    SD-WAN member is used in service and it fails the health-check:
    • When SD-WAN member fails the health-check, it will stop forwarding traffic:
      6: date=2019-04-11 time=13:33:21 logid="0100022923" type="event" subtype="system" level="notice" vd="root" eventtime=1555014801844089814 logdesc="Virtual WAN Link status" interface="R160" msg="The member2(R160) link is unreachable or miss threshold. Stop forwarding traffic. "
    • When SD-WAN member passes the health-check again, it will resume forwarding logs:
      2: date=2019-04-11 time=13:33:36 logid="0100022923" type="event" subtype="system" level="notice" vd="root" eventtime=1555014815914643626 logdesc="Virtual WAN Link status" interface="R160" msg="The member2(R160) link is available. Start forwarding traffic. "
    Load-balance mode service rule's SLA qualified member changes:
    • When load-balance mode service rule's SLA qualified member changes. In this example R150 changes to not meet SLA:
      2: date=2019-04-11 time=14:11:16 logid="0100022923" type="event" subtype="system" level="notice" vd="root" eventtime=1555017075926510687 logdesc="Virtual WAN Link status" msg="Service1(rule2) will be load balanced among members  2(R160) with available routing."
3: date=2019-04-11 time=14:11:16 logid="0100022923" type="event" subtype="system" level="notice" vd="root" eventtime=1555017075926508676 logdesc="Virtual WAN Link status" interface="R150" msg="The member1(R150) SLA order changed from 1 to 2. "
4: date=2019-04-11 time=14:11:16 logid="0100022923" type="event" subtype="system" level="notice" vd="root" eventtime=1555017075926507182 logdesc="Virtual WAN Link status" interface="R160" msg="The member2(R160) SLA order changed from 2 to 1. "
    • When load-balance mode service rule's SLA qualified member changes. In this example R150 changes to meet SLA:
      1: date=2019-04-11 time=14:33:23 logid="0100022923" type="event" subtype="system" level="notice" vd="root" eventtime=1555017075926510668 logdesc="Virtual WAN Link status" msg="Service1(rule2) will be load balanced among members 1(R150) 2(R160) with available routing."
2: date=2019-03-23 time=14:33:23 logid="0100022923" type="event" subtype="system" level="notice" vd="root" eventtime=1553387603592651068 logdesc="Virtual WAN Link status" interface="R160" msg="The member2(R160) link quality packet-loss order changed from 1 to 2. "
3: date=2019-03-23 time=14:33:23 logid="0100022923" type="event" subtype="system" level="notice" vd="root" eventtime=1553387603592651068 logdesc="Virtual WAN Link status" interface="R150" msg="The member1(R150) link quality packet-loss order changed from 2 to 1. "
    SLA link status logs, generated with interval sla-fail-log-period or sla-pass-log-period:
    • When SLA fails, SLA link status logs will be generated with interval sla-fail-log-period:
      7: date=2019-03-23 time=17:45:54 logid="0100022925" type="event" subtype="system" level="notice" vd="root" eventtime=1553388352 logdesc="Link monitor SLA information" name="test" interface="R150" status="up" msg="Latency: 0.016, jitter: 0.002, packet loss: 21.000%, inbandwidth: 0Mbps, outbandwidth: 200Mbps, bibandwidth: 200Mbps, sla_map: 0x0"
    • When SLA passes, SLA link status logs will be generated with interval sla-pass-log-period:
      5: date=2019-03-23 time=17:46:05 logid="0100022925" type="event" subtype="system" level="information" vd="root" eventtime=1553388363 logdesc="Link monitor SLA information" name="test" interface="R150" status="up" msg="Latency: 0.017, jitter: 0.003, packet loss: 0.000%, inbandwidth: 0Mbps, outbandwidth: 200Mbps, bibandwidth: 200Mbps, sla_map: 0x1"
    Previous
    Next