Fortinet Document Library

Version:


Table of Contents

New Features

6.4.0
Download PDF
Copy Link

SD-WAN event log subtype

A separate log subtype, SD-WAN, has been added to Event logs. It consists of seven log IDs:

Log ID

Log description

22923

Virtual WAN link status

22924

Virtual WAN link volume status

22925

Virtual WAN link SLA information

22926

Virtual WAN link neighbor status

22927

Virtual WAN link neighbor standalone

22928

Virtual WAN link neighbor primary

22929

Virtual WAN link neighbor secondary

To filter event logs to show SD-WAN events:
  1. Go to Log & Report > Events.
  2. In the toolbar, click the event dropdown button and select SD-WAN Events. The filtered list of SD-WAN event logs appears, including the Log Description.
  3. Select an entry and click the Details button to view more information about the log.

Sample SD-WAN event logs

Virtual WAN Link status

Event type = HEALTH CHECK
date=2020-03-29 time=16:36:55 logid="0113022923" type="event" subtype="sdwan" level="notice" vd="root" eventtime=1585525015062338339 tz="-0700" logdesc="Virtual WAN Link status" eventtype="Health Check" healthcheck="ping1" slatargetid=1 numpassmember=2 msg="SD-WAN Health Check member(s) pass."
date=2020-03-29 time=16:41:30 logid="0113022923" type="event" subtype="sdwan" level="notice" vd="root" eventtime=1585525290513555981 tz="-0700" logdesc="Virtual WAN Link status" eventtype="Health Check" healthcheck="ping1" slatargetid=1 oldvalue="1" newvalue="2" msg="Number of pass member changed."
date=2020-03-29 time=16:41:30 logid="0113022923" type="event" subtype="sdwan" level="information" vd="root" eventtime=1585525290513553153 tz="-0700" logdesc="Virtual WAN Link status" eventtype="Health Check" healthcheck="ping1" slatargetid=1 member="2" msg="Member status changed. Member in sla."
date=2020-03-29 time=16:40:33 logid="0113022923" type="event" subtype="sdwan" level="notice" vd="root" eventtime=1585525232970358654 tz="-0700" logdesc="Virtual WAN Link status" eventtype="Health Check" healthcheck="ping1" slatargetid=1 member="2" msg="Member status changed. Member out-of-sla."
Event type = SERVICE
date=2020-03-29 time=17:20:13 logid="0113022923" type="event" subtype="sdwan" level="notice" vd="root" eventtime=1585527613995020448 tz="-0700" logdesc="Virtual WAN Link status" eventtype="Service" serviceid=1 service="" metric="latency" seq="1,2" msg="Service prioritized by performance metric will be redirected in sequence order."
date=2020-03-29 time=17:20:13 logid="0113022923" type="event" subtype="sdwan" level="notice" vd="root" eventtime=1585527613995017084 tz="-0700" logdesc="Virtual WAN Link status" eventtype="Service" interface="R160" member="2" serviceid=1 service="" gateway="10.100.1.5" msg="Member link is available. Start forwarding traffic. "
date=2020-03-29 time=17:33:25 logid="0113022923" type="event" subtype="sdwan" level="notice" vd="root" eventtime=1585528405170900938 tz="-0700" logdesc="Virtual WAN Link status" eventtype="Service" serviceid=1 service="service1" msg="Service disabled caused by no outgoing path."
date=2020-03-29 time=17:33:25 logid="0113022923" type="event" subtype="sdwan" level="notice" vd="root" eventtime=1585528405170876948 tz="-0700" logdesc="Virtual WAN Link status" eventtype="Service" serviceid=1 service="service1" msg="Service failover to other available interface(s)."
date=2020-03-29 time=17:33:25 logid="0113022923" type="event" subtype="sdwan" level="notice" vd="root" eventtime=1585528405170874263 tz="-0700" logdesc="Virtual WAN Link status" eventtype="Service" interface="R150" member="1" serviceid=1 service="service1" gateway="10.100.1.1" msg="Member link is unreachable or miss threshold. Stop forwarding traffic. "
date=2020-03-29 time=18:05:14 logid="0113022923" type="event" subtype="sdwan" level="notice" vd="root" eventtime=1585530314708843222 tz="-0700" logdesc="Virtual WAN Link status" eventtype="Service" interface="R150" member="1" serviceid=1 service="service1" gateway="10.100.1.1" metric="packet-loss" oldvalue="1" newvalue="2" msg="The member order changed by performance metric."
date=2020-03-29 time=19:25:40 logid="0113022923" type="event" subtype="sdwan" level="notice" vd="root" eventtime=1585535140122779004 tz="-0700" logdesc="Virtual WAN Link status" eventtype="Service" serviceid=1 service="service1" seq="1,2" msg="Service prioritized by SLA will be redirected in sequence order."
date=2020-03-29 time=19:27:02 logid="0113022923" type="event" subtype="sdwan" level="notice" vd="root" eventtime=1585535222140485480 tz="-0700" logdesc="Virtual WAN Link status" eventtype="Service" interface="R150" member="1" serviceid=1 service="service1" gateway="10.100.1.1" oldvalue="1" newvalue="2" msg="The member SLA order changed."
date=2020-03-29 time=19:38:33 logid="0113022923" type="event" subtype="sdwan" level="notice" vd="root" eventtime=1585535913042763548 tz="-0700" logdesc="Virtual WAN Link status" eventtype="Service" serviceid=1 service="service1" member="1(R150),2(R160)" msg="Service will be load balanced among members with available routing."
date=2020-03-29 time=20:58:50 logid="0113022923" type="event" subtype="sdwan" level="notice" vd="root" eventtime=1585540730662430230 tz="-0700" logdesc="Virtual WAN Link status" eventtype="Service" serviceid=1 service="service1" msg="Service disabled caused by role mismatch."

Virtual WAN Link volume status

Event type = VOLUME
date=2020-03-29 time=20:46:19 logid="0113022924" type="event" subtype="sdwan" level="notice" vd="root" eventtime=1585539979756723714 tz="-0700" logdesc="Virtual WAN Link volume status" eventtype="Volume" interface="port12" member="2" msg="Member enters into conservative status with limited ablity to receive new sessions for too much traffic."
date=2020-03-29 time=20:46:19 logid="0113022924" type="event" subtype="sdwan" level="notice" vd="root" eventtime=1585539979756723714 tz="-0700" logdesc="Virtual WAN Link volume status" eventtype="Volume" interface="wan1" member="2" msg="Member resumes normal status to receive new sessions for internal adjustment."

Virtual WAN Link SLA information

Event type = SLA
date=2020-03-29 time=16:51:27 logid="0113022925" type="event" subtype="sdwan" level="notice" vd="root" eventtime=1585525888177637570 tz="-0700" logdesc="Virtual WAN Link SLA information" eventtype="SLA" healthcheck="ping1" slatargetid=1 interface="R150" status="up" latency="0.013" jitter="0.001" packetloss="100.000%" inbandwidth="0kbps" outbandwidth="0kbps" bibandwidth="0kbps" slamap="0x0" metric="packetloss" msg="Health Check SLA status. SLA failed due to being over the performance metric threshold."
date=2020-03-29 time=16:51:21 logid="0113022925" type="event" subtype="sdwan" level="information" vd="root" eventtime=1585525881177944788 tz="-0700" logdesc="Virtual WAN Link SLA information" eventtype="SLA" healthcheck="ping1" slatargetid=1 interface="R160" status="up" latency="0.010" jitter="0.001" packetloss="0.000%" inbandwidth="0kbps" outbandwidth="0kbps" bibandwidth="0kbps" slamap="0x1" msg="Health Check SLA status."
Event type = HEALTH CHECK
date=2020-03-29 time=16:36:54 logid="0113022925" type="event" subtype="sdwan" level="notice" vd="root" eventtime=1585525014564428201 tz="-0700" logdesc="Virtual WAN Link SLA information" eventtype="Health Check" healthcheck="ping1" interface="R160" probeproto="ping" oldvalue="" newvalue="alive" msg="SD-WAN health-check member initial state."
date=2020-03-29 time=16:55:18 logid="0113022925" type="event" subtype="sdwan" level="warning" vd="root" eventtime=1585526118334582737 tz="-0700" logdesc="Virtual WAN Link SLA information" eventtype="Health Check" healthcheck="ping1" interface="R150" probeproto="ping" oldvalue="alive" newvalue="die" msg="SD-WAN health-check member changed state."
date=2020-03-29 time=16:54:35 logid="0113022925" type="event" subtype="sdwan" level="notice" vd="root" eventtime=1585526075811696627 tz="-0700" logdesc="Virtual WAN Link SLA information" eventtype="Health Check" healthcheck="ping1" interface="R150" probeproto="ping" oldvalue="die" newvalue="alive" msg="SD-WAN health-check member changed state."

Virtual WAN Link Neighbor

Event type = NEIGHBOR
date=2020-03-29 time=20:57:36 logid="0113022926" type="event" subtype="sdwan" level="notice" vd="root" eventtime=1585540656722222479 tz="-0700" logdesc="Virtual WAN Link Neighbor status" eventtype="Neighbor" neighbor="10.100.1.1" member="1" msg="Neighbor(10.100.1.1) for member(1) is unselected forcefully due to configuration change."
date=2020-03-29 time=20:58:51 logid="0113022928" type="event" subtype="sdwan" level="notice" vd="root" eventtime=1585540731163096946 tz="-0700" logdesc="Virtual WAN Link Neighbor primary" eventtype="Neighbor" oldvalue="standalone" newvalue="primary" msg="Selected role is changed."
date=2020-03-29 time=20:58:51 logid="0113022926" type="event" subtype="sdwan" level="notice" vd="root" eventtime=1585540731163094572 tz="-0700" logdesc="Virtual WAN Link Neighbor status" eventtype="Neighbor" neighbor="10.100.1.1" member="1" msg="Neighbor(10.100.1.1) for member(1) is selected."
date=2020-03-29 time=21:01:01 logid="0113022929" type="event" subtype="sdwan" level="warning" vd="root" eventtime=1585540861280903746 tz="-0700" logdesc="Virtual WAN Link Neighbor secondary" eventtype="Neighbor" oldvalue="primary" newvalue="secondary" msg="Selected role is changed."
date=2020-03-29 time=21:01:01 logid="0113022926" type="event" subtype="sdwan" level="notice" vd="root" eventtime=1585540861280842811 tz="-0700" logdesc="Virtual WAN Link Neighbor status" eventtype="Neighbor" neighbor="10.100.1.1" member="1" msg="Neighbor(10.100.1.1) for member(1) is unselected."

SD-WAN event log subtype

A separate log subtype, SD-WAN, has been added to Event logs. It consists of seven log IDs:

Log ID

Log description

22923

Virtual WAN link status

22924

Virtual WAN link volume status

22925

Virtual WAN link SLA information

22926

Virtual WAN link neighbor status

22927

Virtual WAN link neighbor standalone

22928

Virtual WAN link neighbor primary

22929

Virtual WAN link neighbor secondary

To filter event logs to show SD-WAN events:
  1. Go to Log & Report > Events.
  2. In the toolbar, click the event dropdown button and select SD-WAN Events. The filtered list of SD-WAN event logs appears, including the Log Description.
  3. Select an entry and click the Details button to view more information about the log.

Sample SD-WAN event logs

Virtual WAN Link status

Event type = HEALTH CHECK
date=2020-03-29 time=16:36:55 logid="0113022923" type="event" subtype="sdwan" level="notice" vd="root" eventtime=1585525015062338339 tz="-0700" logdesc="Virtual WAN Link status" eventtype="Health Check" healthcheck="ping1" slatargetid=1 numpassmember=2 msg="SD-WAN Health Check member(s) pass."
date=2020-03-29 time=16:41:30 logid="0113022923" type="event" subtype="sdwan" level="notice" vd="root" eventtime=1585525290513555981 tz="-0700" logdesc="Virtual WAN Link status" eventtype="Health Check" healthcheck="ping1" slatargetid=1 oldvalue="1" newvalue="2" msg="Number of pass member changed."
date=2020-03-29 time=16:41:30 logid="0113022923" type="event" subtype="sdwan" level="information" vd="root" eventtime=1585525290513553153 tz="-0700" logdesc="Virtual WAN Link status" eventtype="Health Check" healthcheck="ping1" slatargetid=1 member="2" msg="Member status changed. Member in sla."
date=2020-03-29 time=16:40:33 logid="0113022923" type="event" subtype="sdwan" level="notice" vd="root" eventtime=1585525232970358654 tz="-0700" logdesc="Virtual WAN Link status" eventtype="Health Check" healthcheck="ping1" slatargetid=1 member="2" msg="Member status changed. Member out-of-sla."
Event type = SERVICE
date=2020-03-29 time=17:20:13 logid="0113022923" type="event" subtype="sdwan" level="notice" vd="root" eventtime=1585527613995020448 tz="-0700" logdesc="Virtual WAN Link status" eventtype="Service" serviceid=1 service="" metric="latency" seq="1,2" msg="Service prioritized by performance metric will be redirected in sequence order."
date=2020-03-29 time=17:20:13 logid="0113022923" type="event" subtype="sdwan" level="notice" vd="root" eventtime=1585527613995017084 tz="-0700" logdesc="Virtual WAN Link status" eventtype="Service" interface="R160" member="2" serviceid=1 service="" gateway="10.100.1.5" msg="Member link is available. Start forwarding traffic. "
date=2020-03-29 time=17:33:25 logid="0113022923" type="event" subtype="sdwan" level="notice" vd="root" eventtime=1585528405170900938 tz="-0700" logdesc="Virtual WAN Link status" eventtype="Service" serviceid=1 service="service1" msg="Service disabled caused by no outgoing path."
date=2020-03-29 time=17:33:25 logid="0113022923" type="event" subtype="sdwan" level="notice" vd="root" eventtime=1585528405170876948 tz="-0700" logdesc="Virtual WAN Link status" eventtype="Service" serviceid=1 service="service1" msg="Service failover to other available interface(s)."
date=2020-03-29 time=17:33:25 logid="0113022923" type="event" subtype="sdwan" level="notice" vd="root" eventtime=1585528405170874263 tz="-0700" logdesc="Virtual WAN Link status" eventtype="Service" interface="R150" member="1" serviceid=1 service="service1" gateway="10.100.1.1" msg="Member link is unreachable or miss threshold. Stop forwarding traffic. "
date=2020-03-29 time=18:05:14 logid="0113022923" type="event" subtype="sdwan" level="notice" vd="root" eventtime=1585530314708843222 tz="-0700" logdesc="Virtual WAN Link status" eventtype="Service" interface="R150" member="1" serviceid=1 service="service1" gateway="10.100.1.1" metric="packet-loss" oldvalue="1" newvalue="2" msg="The member order changed by performance metric."
date=2020-03-29 time=19:25:40 logid="0113022923" type="event" subtype="sdwan" level="notice" vd="root" eventtime=1585535140122779004 tz="-0700" logdesc="Virtual WAN Link status" eventtype="Service" serviceid=1 service="service1" seq="1,2" msg="Service prioritized by SLA will be redirected in sequence order."
date=2020-03-29 time=19:27:02 logid="0113022923" type="event" subtype="sdwan" level="notice" vd="root" eventtime=1585535222140485480 tz="-0700" logdesc="Virtual WAN Link status" eventtype="Service" interface="R150" member="1" serviceid=1 service="service1" gateway="10.100.1.1" oldvalue="1" newvalue="2" msg="The member SLA order changed."
date=2020-03-29 time=19:38:33 logid="0113022923" type="event" subtype="sdwan" level="notice" vd="root" eventtime=1585535913042763548 tz="-0700" logdesc="Virtual WAN Link status" eventtype="Service" serviceid=1 service="service1" member="1(R150),2(R160)" msg="Service will be load balanced among members with available routing."
date=2020-03-29 time=20:58:50 logid="0113022923" type="event" subtype="sdwan" level="notice" vd="root" eventtime=1585540730662430230 tz="-0700" logdesc="Virtual WAN Link status" eventtype="Service" serviceid=1 service="service1" msg="Service disabled caused by role mismatch."

Virtual WAN Link volume status

Event type = VOLUME
date=2020-03-29 time=20:46:19 logid="0113022924" type="event" subtype="sdwan" level="notice" vd="root" eventtime=1585539979756723714 tz="-0700" logdesc="Virtual WAN Link volume status" eventtype="Volume" interface="port12" member="2" msg="Member enters into conservative status with limited ablity to receive new sessions for too much traffic."
date=2020-03-29 time=20:46:19 logid="0113022924" type="event" subtype="sdwan" level="notice" vd="root" eventtime=1585539979756723714 tz="-0700" logdesc="Virtual WAN Link volume status" eventtype="Volume" interface="wan1" member="2" msg="Member resumes normal status to receive new sessions for internal adjustment."

Virtual WAN Link SLA information

Event type = SLA
date=2020-03-29 time=16:51:27 logid="0113022925" type="event" subtype="sdwan" level="notice" vd="root" eventtime=1585525888177637570 tz="-0700" logdesc="Virtual WAN Link SLA information" eventtype="SLA" healthcheck="ping1" slatargetid=1 interface="R150" status="up" latency="0.013" jitter="0.001" packetloss="100.000%" inbandwidth="0kbps" outbandwidth="0kbps" bibandwidth="0kbps" slamap="0x0" metric="packetloss" msg="Health Check SLA status. SLA failed due to being over the performance metric threshold."
date=2020-03-29 time=16:51:21 logid="0113022925" type="event" subtype="sdwan" level="information" vd="root" eventtime=1585525881177944788 tz="-0700" logdesc="Virtual WAN Link SLA information" eventtype="SLA" healthcheck="ping1" slatargetid=1 interface="R160" status="up" latency="0.010" jitter="0.001" packetloss="0.000%" inbandwidth="0kbps" outbandwidth="0kbps" bibandwidth="0kbps" slamap="0x1" msg="Health Check SLA status."
Event type = HEALTH CHECK
date=2020-03-29 time=16:36:54 logid="0113022925" type="event" subtype="sdwan" level="notice" vd="root" eventtime=1585525014564428201 tz="-0700" logdesc="Virtual WAN Link SLA information" eventtype="Health Check" healthcheck="ping1" interface="R160" probeproto="ping" oldvalue="" newvalue="alive" msg="SD-WAN health-check member initial state."
date=2020-03-29 time=16:55:18 logid="0113022925" type="event" subtype="sdwan" level="warning" vd="root" eventtime=1585526118334582737 tz="-0700" logdesc="Virtual WAN Link SLA information" eventtype="Health Check" healthcheck="ping1" interface="R150" probeproto="ping" oldvalue="alive" newvalue="die" msg="SD-WAN health-check member changed state."
date=2020-03-29 time=16:54:35 logid="0113022925" type="event" subtype="sdwan" level="notice" vd="root" eventtime=1585526075811696627 tz="-0700" logdesc="Virtual WAN Link SLA information" eventtype="Health Check" healthcheck="ping1" interface="R150" probeproto="ping" oldvalue="die" newvalue="alive" msg="SD-WAN health-check member changed state."

Virtual WAN Link Neighbor

Event type = NEIGHBOR
date=2020-03-29 time=20:57:36 logid="0113022926" type="event" subtype="sdwan" level="notice" vd="root" eventtime=1585540656722222479 tz="-0700" logdesc="Virtual WAN Link Neighbor status" eventtype="Neighbor" neighbor="10.100.1.1" member="1" msg="Neighbor(10.100.1.1) for member(1) is unselected forcefully due to configuration change."
date=2020-03-29 time=20:58:51 logid="0113022928" type="event" subtype="sdwan" level="notice" vd="root" eventtime=1585540731163096946 tz="-0700" logdesc="Virtual WAN Link Neighbor primary" eventtype="Neighbor" oldvalue="standalone" newvalue="primary" msg="Selected role is changed."
date=2020-03-29 time=20:58:51 logid="0113022926" type="event" subtype="sdwan" level="notice" vd="root" eventtime=1585540731163094572 tz="-0700" logdesc="Virtual WAN Link Neighbor status" eventtype="Neighbor" neighbor="10.100.1.1" member="1" msg="Neighbor(10.100.1.1) for member(1) is selected."
date=2020-03-29 time=21:01:01 logid="0113022929" type="event" subtype="sdwan" level="warning" vd="root" eventtime=1585540861280903746 tz="-0700" logdesc="Virtual WAN Link Neighbor secondary" eventtype="Neighbor" oldvalue="primary" newvalue="secondary" msg="Selected role is changed."
date=2020-03-29 time=21:01:01 logid="0113022926" type="event" subtype="sdwan" level="notice" vd="root" eventtime=1585540861280842811 tz="-0700" logdesc="Virtual WAN Link Neighbor status" eventtype="Neighbor" neighbor="10.100.1.1" member="1" msg="Neighbor(10.100.1.1) for member(1) is unselected."