Advanced Bot Protection troubleshooting and debugging
The following tools are available to troubleshoot and debug Advanced Bot Protection issues.
Event logs that record the interactions between FortiADC and FortiGuard Advanced Bot Protection when system events occur
You can check the system event logs to see the communication between FortiADC and FortiGuard ABP.
The following system events are logged:
- Configuration changes to the Advanced Bot Protection policy.
- When FortiADC has successfully reports Advanced Bot Protection policy configurations to FortiGuard ABP.
- When FortiADC fails and retries to report Advanced Bot Protection policy configurations to FortiGuard ABP.
Attack Logs that record interactions between FortiADC and FortiGuard ABP when suspicious behavior is detected
You can check the attack logs to see the WAF action triggered by the response received from FortiGuard ABP.
In the example below, the attack logged a block WAF action that was triggered by FortiGuard ABP detecting suspicious user behavior.
Some interactions may not trigger an attack log.
- When the WAF action for the Advanced Bot Protection policy is set to allow, triggered attacks will not be logged.
- When FortiADC receives an "empty" response from FortiGuard ABP.
- When FortiADC receives a 401 Authentication error (or another error) from FortiGuard ABP.
- When FortiADC does not receive a response from FortiGuard ABP until timeout (10 seconds).
CLI commands to view debug logs relating to Advanced Bot Protection
|
Command |
Guidelines |
|---|---|
|
diagnose debug module wafmonitor all diagnose debug enable |
To view the debug information for interactions between the wafmonitor daemon and the FortiGuard ABP. Interactions include fetching the Advanced Bot Protection policy entries from FortiGuard ABP and reporting FortiADC configurations to FortiGuard ABP. Note: The |
|
diagnose debug module waf advanced_bot |
To view the debug information for traffic processed by the Advanced Bot Protection policy. |
|
diagnose debug module framework_http |
To view the debug information for HTTP packet processing by WAF modules. Note: The |