Fortinet white logo
Fortinet docs logo DOCUMENT LIBRARY
Fortinet white logo
Fortinet docs logo DOCUMENT LIBRARY
Products Best Practices Hardware Guides Products A-Z
Summary
By Solution
By 4D Pillars
By Cloud
Secure Networking
Unified SASE
Security Operations
Secure SD-WAN
Secure Access Service Edge (SASE)
ZTNA
LAN Edge
Identity and Access Management
Next Generation Firewall
Public Cloud
Private Cloud
FortiCloud
Secure Networking
  • Hybrid Mesh Firewall
  • NOC Management
  • LAN
  • WAN
    • More >>
    Unified SASE
  • Single Vendor SASE
  • Cloud Network Security
  • Secure Endpoint Connectivity
  • Web Application / API Protection
    • More >>
    Security Operations
  • Security Operations Automation
  • Identity
  • Early Detection & Prevention
    • More >>
    Secure Networking
  • Hybrid Mesh Firewall
  • NOC Management
  • LAN
  • WAN
  • Communication & Surveillance
    • Unified SASE
  • Single Vendor SASE
  • Secure Endpoint Connectivity
  • Cloud Network Security
  • Cloud-Native Security
  • Web Application / API Protection
    • Security Operations
  • Security Operations Automation
  • Endpoint
  • Data Protection
  • Identity
  • Email
  • Early Detection & Prevention
  • Expert Services
  • Edge Firewall
  • Orchestration & management
  • SD Branch
  • Application Delivery
  • Single Vendor SASE
  • Secure Endpoint Connectivity
  • Secure Private Access
  • Thin Edge
  • Identity
  • Application Gateway
  • Enterprise Asset Management
  • Endpoint Agent
  • Agentless Security Posture
  • Identity
  • Wireless
  • Switching
  • Identity
  • Privilege Acccess Management
  • Next Generation Firewall
  • Orchestration & management
  • Expert Services
  • All
  • All
  • Account Management
  • SAAS Management
  • SAAS Application Security
  • Managed Services
  • Platform as a service (PAAS)
  • Other SAAS Services
    • 4D Resources
    Solution Hubs
  • 4D Pillars
  • Cloud
  • Popular Solutions

    • Administration Guide

    Home FortiAuthenticator 6.5.6 Administration Guide
    6.5.6
    6.6.2
    6.6.1
    6.6.0
    6.5.6
    6.5.5
    6.5.4
    6.5.3
    6.5.2
    6.5.1
    6.5.0
    6.4.10
    6.4.9
    6.4.8
    6.4.7
    6.4.6
    6.4.5
    6.4.4
    6.4.3
    6.4.2
    6.4.1
    6.4.0
    6.3.4
    6.3.3
    6.3.2
    6.3.1
    6.3.0
    6.2.2
    6.2.1
    6.2.0
    6.1.3
    6.1.2
    6.1.1
    6.1.0
    6.0.8
    6.0.7
    6.0.6
    6.0.5
    6.0.4
    6.0.3
    6.0.2
    6.0.1
    6.0.0
    5.5.0
    5.4.0
    5.3.0
    5.2.0
    5.1.0
    5.0.0
    4.3.0
    4.2.1
    4.2.0

    Debug logs

    Debug logs

    Extended debug logs can be accessed by using your web browser to browse to https://<FortiAuthenticator-IP-Address>/debug.

    Log Categories

    From the tree menu select a log type:

    • RADIUS: Authentication, Accounting, Accounting Monitor, and DNS Updates.

    • TACACS+: General, Authentication, Accounting, and Authorization.

    • Web Server: Apache, WAD, and FastAPI. See FastAPI debug mode.

    • High Availability: Slony, Load Balancing, and Load Balancing HA Sync.

    • Single Sign On: FSSO Agent, FSSO Agent Filtered, and Domain Manager, and Syslog SSO.

    • User Sync: LDAP and SAML.

    • Other: GUI, REST API, LDAP, Windows AD Monitor, SNMP, Disk Monitor, Hardware Monitor, and Kernel.

    Note: The CLI Packet Capture (tcpdumpfile) log category is only available when the tcpdumpfile command has been entered using SSH or Telnet, or through the CLI Console if a FortiAuthenticator is installed on a FortiHypervisor. For more information, see CLI commands.

    Debug Kit

    Select Upload a file to upload a debug kit from your computer.

    Note: The option is only available for some log types.

    Max. log files size

    From the dropdown, select the maximum log file size. You can select up to a maximum of 500 MB. This gives you access to an extended history of debug files.

    Note: The option is only available for some log types.

    Log level

    From the dropdown, select the log severity level.

    Enter debug mode

    If HA or RADIUS Authentication is selected from the log category, the option to enter the debug mode is available. See RADIUS debugging.

    Enter detail debugging mode

    You can enter detailed debugging mode if RADIUS Authentication is selected from the log category.

    See RADIUS debugging.

    Search

    Enter a search term in the search field, then select Search to search the debug logs.

    Page navigation

    Use the First Page, Previous Page, Next Page, and Last Page icons to navigated through the logs.

    Show

    Select the number of lines to show per page from the dropdown menu. The options are: 100 (default), 250, and 500.

    RADIUS debugging

    RADIUS authentication debugging mode can be accessed to debug RADIUS authentication issues.

    From the Log Categories menu, select RADIUS Authentication and select Enter debug mode from the toolbar.

    Enter the username and password and select OK to test the RADIUS authentication and view the authentication response and returned attributes.

    Select Enter detail debug mode to enter the detailed debug mode.

    Enter the username and password and select OK to test the RADIUS authentication and view the authentication response and returned attributes.

    Select Exit debug mode to deactivate the debugging mode.

    The following table lists the related CLI commands and GUI elements for RADIUS debugging:

    CLI command

    Description

    GUI

    debug radius 0

    Put the RADIUS service into normal running mode (only error and system info debug logs).

    Exit debug mode

    debug radius 1

    Put the RADIUS service into debug mode.

    Note: debug radius 1 is the normal running mode in 6.4.x and below.

    Enter debug mode

    debug radius 2

    Put the RADIUS service into detailed debug mode.

    Note: debug radius 2 is the debug mode in 6.4.x and below.

    Enter detail debug mode

    After a reboot, the RADIUS service will automatically be in normal running mode (equivalent to debug radius 0).

    TCP stack hardening

    Configure the number of TCP SYNACK retries for the Linux kernel by accessing:

    https://<FortiAuthenticator-IP-Address>/debug/tcp_tuning

    From here, enter the number of retries between 1 - 255 (default is 3) and then select Save.

    FastAPI debug mode

    When FastAPI is selected in Log Categories > Web Server, Enable FastAPI Debug Mode button is available. Clicking Enable FastAPI Debug Mode allows you to record the activity according to the selected options:

    Max request amount

    The maximum number of requests:

    • 50 (default)

    • 100

    • 150

    • 200

    • 250

    Debug run time

    The debug run time:

    • 1 Minutes (default)

    • 10 Minutes

    • 1 Hour

    • 2 Hours

    • 4 Hours

    • 6 Hours

    • 1 Day

    For example, if the Max request amount is set to 50 and the Debug run time is 1 Minutes, the FortiAuthenticator profiler tool saves the 50 slowest HTTP requests within the next 1 minute.

    High level details of the slowest HTTP requests are displayed in the Log Categories > Web Server > FastAPI page.

    Once the Debug run time has elapsed, click Download to download a report generated by the profiler tool with additional information.

    Previous
    Next

    Debug logs

    Debug logs

    Extended debug logs can be accessed by using your web browser to browse to https://<FortiAuthenticator-IP-Address>/debug.

    Log Categories

    From the tree menu select a log type:

    • RADIUS: Authentication, Accounting, Accounting Monitor, and DNS Updates.

    • TACACS+: General, Authentication, Accounting, and Authorization.

    • Web Server: Apache, WAD, and FastAPI. See FastAPI debug mode.

    • High Availability: Slony, Load Balancing, and Load Balancing HA Sync.

    • Single Sign On: FSSO Agent, FSSO Agent Filtered, and Domain Manager, and Syslog SSO.

    • User Sync: LDAP and SAML.

    • Other: GUI, REST API, LDAP, Windows AD Monitor, SNMP, Disk Monitor, Hardware Monitor, and Kernel.

    Note: The CLI Packet Capture (tcpdumpfile) log category is only available when the tcpdumpfile command has been entered using SSH or Telnet, or through the CLI Console if a FortiAuthenticator is installed on a FortiHypervisor. For more information, see CLI commands.

    Debug Kit

    Select Upload a file to upload a debug kit from your computer.

    Note: The option is only available for some log types.

    Max. log files size

    From the dropdown, select the maximum log file size. You can select up to a maximum of 500 MB. This gives you access to an extended history of debug files.

    Note: The option is only available for some log types.

    Log level

    From the dropdown, select the log severity level.

    Enter debug mode

    If HA or RADIUS Authentication is selected from the log category, the option to enter the debug mode is available. See RADIUS debugging.

    Enter detail debugging mode

    You can enter detailed debugging mode if RADIUS Authentication is selected from the log category.

    See RADIUS debugging.

    Search

    Enter a search term in the search field, then select Search to search the debug logs.

    Page navigation

    Use the First Page, Previous Page, Next Page, and Last Page icons to navigated through the logs.

    Show

    Select the number of lines to show per page from the dropdown menu. The options are: 100 (default), 250, and 500.

    RADIUS debugging

    RADIUS authentication debugging mode can be accessed to debug RADIUS authentication issues.

    From the Log Categories menu, select RADIUS Authentication and select Enter debug mode from the toolbar.

    Enter the username and password and select OK to test the RADIUS authentication and view the authentication response and returned attributes.

    Select Enter detail debug mode to enter the detailed debug mode.

    Enter the username and password and select OK to test the RADIUS authentication and view the authentication response and returned attributes.

    Select Exit debug mode to deactivate the debugging mode.

    The following table lists the related CLI commands and GUI elements for RADIUS debugging:

    CLI command

    Description

    GUI

    debug radius 0

    Put the RADIUS service into normal running mode (only error and system info debug logs).

    Exit debug mode

    debug radius 1

    Put the RADIUS service into debug mode.

    Note: debug radius 1 is the normal running mode in 6.4.x and below.

    Enter debug mode

    debug radius 2

    Put the RADIUS service into detailed debug mode.

    Note: debug radius 2 is the debug mode in 6.4.x and below.

    Enter detail debug mode

    After a reboot, the RADIUS service will automatically be in normal running mode (equivalent to debug radius 0).

    TCP stack hardening

    Configure the number of TCP SYNACK retries for the Linux kernel by accessing:

    https://<FortiAuthenticator-IP-Address>/debug/tcp_tuning

    From here, enter the number of retries between 1 - 255 (default is 3) and then select Save.

    FastAPI debug mode

    When FastAPI is selected in Log Categories > Web Server, Enable FastAPI Debug Mode button is available. Clicking Enable FastAPI Debug Mode allows you to record the activity according to the selected options:

    Max request amount

    The maximum number of requests:

    • 50 (default)

    • 100

    • 150

    • 200

    • 250

    Debug run time

    The debug run time:

    • 1 Minutes (default)

    • 10 Minutes

    • 1 Hour

    • 2 Hours

    • 4 Hours

    • 6 Hours

    • 1 Day

    For example, if the Max request amount is set to 50 and the Debug run time is 1 Minutes, the FortiAuthenticator profiler tool saves the 50 slowest HTTP requests within the next 1 minute.

    High level details of the slowest HTTP requests are displayed in the Log Categories > Web Server > FastAPI page.

    Once the Debug run time has elapsed, click Download to download a report generated by the profiler tool with additional information.

    Previous
    Next