Request debug bundle

Requirements: Windows, macOS, or Linux.

Debug bundles can be obtained using the FortiDLP Console—helping Fortinet tackle support cases faster.

Supported for all OSs, the request debug bundle action prompts the FortiDLP Agent to upload its debug bundle to the FortiDLP Infrastructure. It is then made available for download from the Node profile page and the Action details panel.

How to request a debug bundle for a managed node

1. In the FortiDLP Console, on the left-hand sidebar, click .
   
2. Filter for the relevant node. For guidance on this, see Nodes.
3. In the Table tab, select the row of the node.
4. On the Node profile page, click Perform action.
5. In the Actions dialog box, do the following:
   1. Click Request debug bundle.
   2. Do one of the following:
      • To collect a standard debug bundle:
        1. Optionally, alter the request timeout period.
        2. Click Request debug bundle.
           
      • To collect a verbose debug bundle:
        1. Select the Request verbose debug bundle checkbox. A verbose debug bundle contains more information and takes longer to compile.
        2. Optionally, alter the request timeout period.
        3. Click Request debug bundle.
      The debug bundle is generated.
6. To view the bundle, do the following:
   1. Click Close to exit the dialog box.
   2. In the Bundles and reports widget, for the relevant bundle, click .
      
      A ZIP file is downloaded to your device.

      Pending action requests for debug bundles will display with a "Requested" badge. You can check for pending actions by sending a GET request to the FortiDLP API's /api/v1/actions/{agent_uuid}/in-flight endpoint.

   3. Extract the ZIP file.

You can also download the bundle from the Action details panel, accessible from the Action (New) or Action (Legacy) event stream (depending on the Agent version). In the Investigate module, just enter the action = debug_bundle search query and then open the panel for the relevant action event. For detailed information about the Investigate module, see Investigate.