Fortinet black logo

Administration Guide

Understanding SD-WAN related logs

Understanding SD-WAN related logs

This topic lists the SD-WAN related logs and explains when the logs will be triggered.

Health-check detects a failure:
  • When health-check detects a failure, it will record a log:
    34: date=2019-03-23 time=17:26:06 logid="0100022921" type="event" subtype="system" level="critical" vd="root" eventtime=1553387165 logdesc="Routing information changed" name="test" interface="R150" status="down" msg="Static route on interface R150 may be removed by health-check test. Route:  (10.100.1.2->10.100.2.22 ping-down)"
  • When health-check detects a recovery, it will record a log:
    32: date=2019-03-23 time=17:26:54 logid="0100022921" type="event" subtype="system" level="critical" vd="root" eventtime=1553387214 logdesc="Routing information changed" name="test" interface="R150" status="up" msg="Static route on interface R150 may be added by health-check test. Route:  (10.100.1.2->10.100.2.22 ping-up)"
Health-check has an SLA target and detects SLA qualification changes:
  • When health-check has an SLA target and detects SLA changes, and changes to fail:
    5: date=2019-04-11 time=11:48:39 logid="0100022923" type="event" subtype="system" level="notice" vd="root" eventtime=1555008519816639290 logdesc="Virtual WAN Link status" msg="SD-WAN Health Check(ping) SLA(1): number of pass members changes from 2 to 1."
  • When health-check has an SLA target and detects SLA changes, and changes to pass:
    2: date=2019-04-11 time=11:49:46 logid="0100022923" type="event" subtype="system" level="notice" vd="root" eventtime=1555008586149038471 logdesc="Virtual WAN Link status" msg="SD-WAN Health Check(ping) SLA(1): number of pass members changes from 1 to 2."
SD-WAN calculates a link's session/bandwidth over/under its ratio and stops/resumes traffic:
  • When SD-WAN calculates a link's session/bandwidth over its configured ratio and stops forwarding traffic:
    3: date=2019-04-10 time=17:15:40 logid="0100022924" type="event" subtype="system" level="notice" vd="root" eventtime=1554941740185866628 logdesc="Virtual WAN Link volume status" interface="R160" msg="The member(3) enters into conservative status with limited ablity to receive new sessions for too much traffic."
  • When SD-WAN calculates a link's session/bandwidth according to its ratio and resumes forwarding traffic:
    1: date=2019-04-10 time=17:20:39 logid="0100022924" type="event" subtype="system" level="notice" vd="root" eventtime=1554942040196041728 logdesc="Virtual WAN Link volume status" interface="R160" msg="The member(3) resume normal status to receive new sessions for internal adjustment."
The SLA mode service rule's SLA qualified member changes:
  • When the SLA mode service rule's SLA qualified member changes. In this example R150 fails the SLA check, but is still alive:
    14: date=2019-03-23 time=17:44:12 logid="0100022923" type="event" subtype="system" level="notice" vd="root" eventtime=1553388252 logdesc="Virtual WAN Link status" msg="Service2() prioritized by SLA will be redirected in seq-num order 2(R160) 1(R150)."
    15: date=2019-03-23 time=17:44:12 logid="0100022923" type="event" subtype="system" level="notice" vd="root" eventtime=1553388252 logdesc="Virtual WAN Link status" interface="R150" msg="The member1(R150) SLA order changed from 1 to 2. "
    16: date=2019-03-23 time=17:44:12 logid="0100022923" type="event" subtype="system" level="notice" vd="root" eventtime=1553388252 logdesc="Virtual WAN Link status" interface="R160" msg="The member2(R160) SLA order changed from 2 to 1. "
  • When the SLA mode service rule's SLA qualified member changes. In this example R150 changes from fail to pass:
    1: date=2019-03-23 time=17:46:05 logid="0100022923" type="event" subtype="system" level="notice" vd="root" eventtime=1553388365 logdesc="Virtual WAN Link status" msg="Service2() prioritized by SLA will be redirected in seq-num order 1(R150) 2(R160)."
    2: date=2019-03-23 time=17:46:05 logid="0100022923" type="event" subtype="system" level="notice" vd="root" eventtime=1553388365 logdesc="Virtual WAN Link status" interface="R160" msg="The member2(R160) SLA order changed from 1 to 2. "
    3: date=2019-03-23 time=17:46:05 logid="0100022923" type="event" subtype="system" level="notice" vd="root" eventtime=1553388365 logdesc="Virtual WAN Link status" interface="R150" msg="The member1(R150) SLA order changed from 2 to 1. "
The priority mode service rule member's link status changes:
  • When priority mode service rule member's link status changes. In this example R150 changes to better than R160, and both are still alive:
    1: date=2019-03-23 time=17:33:23 logid="0100022923" type="event" subtype="system" level="notice" vd="root" eventtime=1553387603 logdesc="Virtual WAN Link status" msg="Service2() prioritized by packet-loss will be redirected in seq-num order 1(R150) 2(R160)."
    2: date=2019-03-23 time=17:33:23 logid="0100022923" type="event" subtype="system" level="notice" vd="root" eventtime=1553387603 logdesc="Virtual WAN Link status" interface="R160" msg="The member2(R160) link quality packet-loss order changed from 1 to 2. "
    3: date=2019-03-23 time=17:33:23 logid="0100022923" type="event" subtype="system" level="notice" vd="root" eventtime=1553387603 logdesc="Virtual WAN Link status" interface="R150" msg="The member1(R150) link quality packet-loss order changed from 2 to 1. "
  • When priority mode service rule member's link status changes. In this example R160 changes to better than R150, and both are still alive:
    6: date=2019-03-23 time=17:32:01 logid="0100022923" type="event" subtype="system" level="notice" vd="root" eventtime=1553387520 logdesc="Virtual WAN Link status" msg="Service2() prioritized by packet-loss will be redirected in seq-num order 2(R160) 1(R150)."
    7: date=2019-03-23 time=17:32:01 logid="0100022923" type="event" subtype="system" level="notice" vd="root" eventtime=1553387520 logdesc="Virtual WAN Link status" interface="R150" msg="The member1(R150) link quality packet-loss order changed from 1 to 2. "
    8: date=2019-03-23 time=17:32:01 logid="0100022923" type="event" subtype="system" level="notice" vd="root" eventtime=1553387520 logdesc="Virtual WAN Link status" interface="R160" msg="The member2(R160) link quality packet-loss order changed from 2 to 1. "
SD-WAN member is used in service and it fails the health-check:
  • When SD-WAN member fails the health-check, it will stop forwarding traffic:
    6: date=2019-04-11 time=13:33:21 logid="0100022923" type="event" subtype="system" level="notice" vd="root" eventtime=1555014801844089814 logdesc="Virtual WAN Link status" interface="R160" msg="The member2(R160) link is unreachable or miss threshold. Stop forwarding traffic. "
  • When SD-WAN member passes the health-check again, it will resume forwarding logs:
    2: date=2019-04-11 time=13:33:36 logid="0100022923" type="event" subtype="system" level="notice" vd="root" eventtime=1555014815914643626 logdesc="Virtual WAN Link status" interface="R160" msg="The member2(R160) link is available. Start forwarding traffic. "
Load-balance mode service rule's SLA qualified member changes:
  • When load-balance mode service rule's SLA qualified member changes. In this example R150 changes to not meet SLA:
    2: date=2019-04-11 time=14:11:16 logid="0100022923" type="event" subtype="system" level="notice" vd="root" eventtime=1555017075926510687 logdesc="Virtual WAN Link status" msg="Service1(rule2) will be load balanced among members  2(R160) with available routing."
    3: date=2019-04-11 time=14:11:16 logid="0100022923" type="event" subtype="system" level="notice" vd="root" eventtime=1555017075926508676 logdesc="Virtual WAN Link status" interface="R150" msg="The member1(R150) SLA order changed from 1 to 2. "
    4: date=2019-04-11 time=14:11:16 logid="0100022923" type="event" subtype="system" level="notice" vd="root" eventtime=1555017075926507182 logdesc="Virtual WAN Link status" interface="R160" msg="The member2(R160) SLA order changed from 2 to 1. "
  • When load-balance mode service rule's SLA qualified member changes. In this example R150 changes to meet SLA:
    1: date=2019-04-11 time=14:33:23 logid="0100022923" type="event" subtype="system" level="notice" vd="root" eventtime=1555017075926510668 logdesc="Virtual WAN Link status" msg="Service1(rule2) will be load balanced among members 1(R150) 2(R160) with available routing."
    2: date=2019-03-23 time=14:33:23 logid="0100022923" type="event" subtype="system" level="notice" vd="root" eventtime=1553387603592651068 logdesc="Virtual WAN Link status" interface="R160" msg="The member2(R160) link quality packet-loss order changed from 1 to 2. "
    3: date=2019-03-23 time=14:33:23 logid="0100022923" type="event" subtype="system" level="notice" vd="root" eventtime=1553387603592651068 logdesc="Virtual WAN Link status" interface="R150" msg="The member1(R150) link quality packet-loss order changed from 2 to 1. "
SLA link status logs, generated with interval sla-fail-log-period or sla-pass-log-period:
  • When SLA fails, SLA link status logs will be generated with interval sla-fail-log-period:
    7: date=2019-03-23 time=17:45:54 logid="0100022925" type="event" subtype="system" level="notice" vd="root" eventtime=1553388352 logdesc="Link monitor SLA information" name="test" interface="R150" status="up" msg="Latency: 0.016, jitter: 0.002, packet loss: 21.000%, inbandwidth: 0Mbps, outbandwidth: 200Mbps, bibandwidth: 200Mbps, sla_map: 0x0"
  • When SLA passes, SLA link status logs will be generated with interval sla-pass-log-period:
    5: date=2019-03-23 time=17:46:05 logid="0100022925" type="event" subtype="system" level="information" vd="root" eventtime=1553388363 logdesc="Link monitor SLA information" name="test" interface="R150" status="up" msg="Latency: 0.017, jitter: 0.003, packet loss: 0.000%, inbandwidth: 0Mbps, outbandwidth: 200Mbps, bibandwidth: 200Mbps, sla_map: 0x1"

Understanding SD-WAN related logs

This topic lists the SD-WAN related logs and explains when the logs will be triggered.

Health-check detects a failure:
  • When health-check detects a failure, it will record a log:
    34: date=2019-03-23 time=17:26:06 logid="0100022921" type="event" subtype="system" level="critical" vd="root" eventtime=1553387165 logdesc="Routing information changed" name="test" interface="R150" status="down" msg="Static route on interface R150 may be removed by health-check test. Route:  (10.100.1.2->10.100.2.22 ping-down)"
  • When health-check detects a recovery, it will record a log:
    32: date=2019-03-23 time=17:26:54 logid="0100022921" type="event" subtype="system" level="critical" vd="root" eventtime=1553387214 logdesc="Routing information changed" name="test" interface="R150" status="up" msg="Static route on interface R150 may be added by health-check test. Route:  (10.100.1.2->10.100.2.22 ping-up)"
Health-check has an SLA target and detects SLA qualification changes:
  • When health-check has an SLA target and detects SLA changes, and changes to fail:
    5: date=2019-04-11 time=11:48:39 logid="0100022923" type="event" subtype="system" level="notice" vd="root" eventtime=1555008519816639290 logdesc="Virtual WAN Link status" msg="SD-WAN Health Check(ping) SLA(1): number of pass members changes from 2 to 1."
  • When health-check has an SLA target and detects SLA changes, and changes to pass:
    2: date=2019-04-11 time=11:49:46 logid="0100022923" type="event" subtype="system" level="notice" vd="root" eventtime=1555008586149038471 logdesc="Virtual WAN Link status" msg="SD-WAN Health Check(ping) SLA(1): number of pass members changes from 1 to 2."
SD-WAN calculates a link's session/bandwidth over/under its ratio and stops/resumes traffic:
  • When SD-WAN calculates a link's session/bandwidth over its configured ratio and stops forwarding traffic:
    3: date=2019-04-10 time=17:15:40 logid="0100022924" type="event" subtype="system" level="notice" vd="root" eventtime=1554941740185866628 logdesc="Virtual WAN Link volume status" interface="R160" msg="The member(3) enters into conservative status with limited ablity to receive new sessions for too much traffic."
  • When SD-WAN calculates a link's session/bandwidth according to its ratio and resumes forwarding traffic:
    1: date=2019-04-10 time=17:20:39 logid="0100022924" type="event" subtype="system" level="notice" vd="root" eventtime=1554942040196041728 logdesc="Virtual WAN Link volume status" interface="R160" msg="The member(3) resume normal status to receive new sessions for internal adjustment."
The SLA mode service rule's SLA qualified member changes:
  • When the SLA mode service rule's SLA qualified member changes. In this example R150 fails the SLA check, but is still alive:
    14: date=2019-03-23 time=17:44:12 logid="0100022923" type="event" subtype="system" level="notice" vd="root" eventtime=1553388252 logdesc="Virtual WAN Link status" msg="Service2() prioritized by SLA will be redirected in seq-num order 2(R160) 1(R150)."
    15: date=2019-03-23 time=17:44:12 logid="0100022923" type="event" subtype="system" level="notice" vd="root" eventtime=1553388252 logdesc="Virtual WAN Link status" interface="R150" msg="The member1(R150) SLA order changed from 1 to 2. "
    16: date=2019-03-23 time=17:44:12 logid="0100022923" type="event" subtype="system" level="notice" vd="root" eventtime=1553388252 logdesc="Virtual WAN Link status" interface="R160" msg="The member2(R160) SLA order changed from 2 to 1. "
  • When the SLA mode service rule's SLA qualified member changes. In this example R150 changes from fail to pass:
    1: date=2019-03-23 time=17:46:05 logid="0100022923" type="event" subtype="system" level="notice" vd="root" eventtime=1553388365 logdesc="Virtual WAN Link status" msg="Service2() prioritized by SLA will be redirected in seq-num order 1(R150) 2(R160)."
    2: date=2019-03-23 time=17:46:05 logid="0100022923" type="event" subtype="system" level="notice" vd="root" eventtime=1553388365 logdesc="Virtual WAN Link status" interface="R160" msg="The member2(R160) SLA order changed from 1 to 2. "
    3: date=2019-03-23 time=17:46:05 logid="0100022923" type="event" subtype="system" level="notice" vd="root" eventtime=1553388365 logdesc="Virtual WAN Link status" interface="R150" msg="The member1(R150) SLA order changed from 2 to 1. "
The priority mode service rule member's link status changes:
  • When priority mode service rule member's link status changes. In this example R150 changes to better than R160, and both are still alive:
    1: date=2019-03-23 time=17:33:23 logid="0100022923" type="event" subtype="system" level="notice" vd="root" eventtime=1553387603 logdesc="Virtual WAN Link status" msg="Service2() prioritized by packet-loss will be redirected in seq-num order 1(R150) 2(R160)."
    2: date=2019-03-23 time=17:33:23 logid="0100022923" type="event" subtype="system" level="notice" vd="root" eventtime=1553387603 logdesc="Virtual WAN Link status" interface="R160" msg="The member2(R160) link quality packet-loss order changed from 1 to 2. "
    3: date=2019-03-23 time=17:33:23 logid="0100022923" type="event" subtype="system" level="notice" vd="root" eventtime=1553387603 logdesc="Virtual WAN Link status" interface="R150" msg="The member1(R150) link quality packet-loss order changed from 2 to 1. "
  • When priority mode service rule member's link status changes. In this example R160 changes to better than R150, and both are still alive:
    6: date=2019-03-23 time=17:32:01 logid="0100022923" type="event" subtype="system" level="notice" vd="root" eventtime=1553387520 logdesc="Virtual WAN Link status" msg="Service2() prioritized by packet-loss will be redirected in seq-num order 2(R160) 1(R150)."
    7: date=2019-03-23 time=17:32:01 logid="0100022923" type="event" subtype="system" level="notice" vd="root" eventtime=1553387520 logdesc="Virtual WAN Link status" interface="R150" msg="The member1(R150) link quality packet-loss order changed from 1 to 2. "
    8: date=2019-03-23 time=17:32:01 logid="0100022923" type="event" subtype="system" level="notice" vd="root" eventtime=1553387520 logdesc="Virtual WAN Link status" interface="R160" msg="The member2(R160) link quality packet-loss order changed from 2 to 1. "
SD-WAN member is used in service and it fails the health-check:
  • When SD-WAN member fails the health-check, it will stop forwarding traffic:
    6: date=2019-04-11 time=13:33:21 logid="0100022923" type="event" subtype="system" level="notice" vd="root" eventtime=1555014801844089814 logdesc="Virtual WAN Link status" interface="R160" msg="The member2(R160) link is unreachable or miss threshold. Stop forwarding traffic. "
  • When SD-WAN member passes the health-check again, it will resume forwarding logs:
    2: date=2019-04-11 time=13:33:36 logid="0100022923" type="event" subtype="system" level="notice" vd="root" eventtime=1555014815914643626 logdesc="Virtual WAN Link status" interface="R160" msg="The member2(R160) link is available. Start forwarding traffic. "
Load-balance mode service rule's SLA qualified member changes:
  • When load-balance mode service rule's SLA qualified member changes. In this example R150 changes to not meet SLA:
    2: date=2019-04-11 time=14:11:16 logid="0100022923" type="event" subtype="system" level="notice" vd="root" eventtime=1555017075926510687 logdesc="Virtual WAN Link status" msg="Service1(rule2) will be load balanced among members  2(R160) with available routing."
    3: date=2019-04-11 time=14:11:16 logid="0100022923" type="event" subtype="system" level="notice" vd="root" eventtime=1555017075926508676 logdesc="Virtual WAN Link status" interface="R150" msg="The member1(R150) SLA order changed from 1 to 2. "
    4: date=2019-04-11 time=14:11:16 logid="0100022923" type="event" subtype="system" level="notice" vd="root" eventtime=1555017075926507182 logdesc="Virtual WAN Link status" interface="R160" msg="The member2(R160) SLA order changed from 2 to 1. "
  • When load-balance mode service rule's SLA qualified member changes. In this example R150 changes to meet SLA:
    1: date=2019-04-11 time=14:33:23 logid="0100022923" type="event" subtype="system" level="notice" vd="root" eventtime=1555017075926510668 logdesc="Virtual WAN Link status" msg="Service1(rule2) will be load balanced among members 1(R150) 2(R160) with available routing."
    2: date=2019-03-23 time=14:33:23 logid="0100022923" type="event" subtype="system" level="notice" vd="root" eventtime=1553387603592651068 logdesc="Virtual WAN Link status" interface="R160" msg="The member2(R160) link quality packet-loss order changed from 1 to 2. "
    3: date=2019-03-23 time=14:33:23 logid="0100022923" type="event" subtype="system" level="notice" vd="root" eventtime=1553387603592651068 logdesc="Virtual WAN Link status" interface="R150" msg="The member1(R150) link quality packet-loss order changed from 2 to 1. "
SLA link status logs, generated with interval sla-fail-log-period or sla-pass-log-period:
  • When SLA fails, SLA link status logs will be generated with interval sla-fail-log-period:
    7: date=2019-03-23 time=17:45:54 logid="0100022925" type="event" subtype="system" level="notice" vd="root" eventtime=1553388352 logdesc="Link monitor SLA information" name="test" interface="R150" status="up" msg="Latency: 0.016, jitter: 0.002, packet loss: 21.000%, inbandwidth: 0Mbps, outbandwidth: 200Mbps, bibandwidth: 200Mbps, sla_map: 0x0"
  • When SLA passes, SLA link status logs will be generated with interval sla-pass-log-period:
    5: date=2019-03-23 time=17:46:05 logid="0100022925" type="event" subtype="system" level="information" vd="root" eventtime=1553388363 logdesc="Link monitor SLA information" name="test" interface="R150" status="up" msg="Latency: 0.017, jitter: 0.003, packet loss: 0.000%, inbandwidth: 0Mbps, outbandwidth: 200Mbps, bibandwidth: 200Mbps, sla_map: 0x1"