Fortinet black logo

System log messages

Copy Link
Copy Doc ID c644536c-3942-11ed-9d74-fa163e15d75b:265060
Download PDF

System log messages

The log messages in this section are issues related to the overall operation of the FortiSwitch unit.

Alarm created

ID

30100

Type

Event log

Subtype

System

Severity

Alert

Message

msg=\"<alarm_ID>\"

Meaning

An alarm occurred.

Alarm acknowledged

ID

30101

Type

Event log

Subtype

System

Severity

Alert

Message

msg=\"<alarm_ID>\"

Meaning

The alarm was acknowledged.

Domain name in alert email cannot be resolved

ID

30150

Type

Event log

Subtype

System

Severity

Notice

Message

msg=\"Can't resolve the IP address of <alert_email_address_sender>\"

Meaning

The domain name of the sender of the alert email cannot be resolved.

FortiSwitch unit started

ID

30200

Type

Event log

Subtype

System

Severity

Information

Message

msg=\"FortiSwitch started <time>\"

Meaning

The FortiSwitch unit was started.

FortiSwitch unit rebooted or shut down

ID

30201

Type

Event log

Subtype

System

Severity

Critical

Message

  • msg=\"User <user_name> rebooted the device. The reason is 'restore configuration'\"
  • msg=\"User <user_name> rebooted the device from <IP_address>\"
  • msg=\"User <user_name> shutdown the device from <IP_address>\"

Meaning

The specified user rebooted or shut down the FortiSwitch unit.

Daily FortiSwitch unit restart

ID

30202

Type

Event log

Subtype

System

Severity

Critical

Message

msg=\"System will reboot due to scheduled daily restart.\"

Meaning

The FortiSwitch unit is being rebooted because it was scheduled to restart daily.

CA certificate will be automatically updated

ID

30300

Type

Event log

Subtype

System

Severity

Warning

Message

msg=\"CA certificate <certificate_name> will auto-update in <number_of_days> days.\"

Meaning

The certificate authority (CA) certificate will automatically update in the specified number of days.

Local certificate will be automatically regenerated

ID

30301

Type

Event log

Subtype

System

Severity

Warning

Message

msg=\"Local certificate <certificate_name> will auto-regenerate in <number_of_days> days.\"

Meaning

The local certificate will automatically regenerate in the specified number of days.

Certificate failed to automatically update

ID

30302

Type

Event log

Subtype

System

Severity

Error

Message

msg=\"<certificate_name>\"

Meaning

The certificate failed to automatically update.

Certificate failed to automatically regenerate

ID

30303

Type

Event log

Subtype

System

Severity

Error

Message

msg=\"<certificate_name>\"

Meaning

The certificate failed to automatically regenerate.

PKCS #12 certificate imported

ID

30304

Type

Event log

Subtype

System

Severity

Critical

Message

msg=\"User <user_name> imported the certificate from <path>\"

Meaning

The specified user imported a PKCS #12 certificate.

CRL update requested

ID

30306

Type

Event log

Subtype

System

Severity

Notice

Message

msg=\"User <user_name> requested a CRL update from <URL>\"

Meaning

The specified user requested an update for a certificate revocation list (CRL).

Power supply restored

ID

30400

Type

Event log

Subtype

System

Severity

Critical

Message

msg=\"Power supply <unit_ID> restore\"

Meaning

The specified power supply unit was restored.

Power supply failed

ID

30401

Type

Event log

Subtype

System

Severity

Critical

Message

msg=\"Power supply <unit_ID> failure\"

Meaning

The specified power supply unit failed.

System configuration changed

ID

30500

Type

Event log

Subtype

System

Severity

Alert

Message

  • msg=\"<user_name> made a change from <module>:<submodule>\"
  • msg=\"Configuration is changed in the admin session\"

Meaning

The specified user changed the system configuration.

System configuration changed using the GUI

ID

30501

Type

Event log

Subtype

System

Severity

Varies

Message

msg=\"User <user_name> made a change via <GUI>: <submodule>\"

Meaning

The specified user changed the system configuration from the GUI.

System configuration restored

ID

30502

Type

Event log

Subtype

System

Severity

Critical

Message

msg=\"User <user_name> restored the configuration from <IP_address>\"

Meaning

The specified user restored the system configuration.

Restoring the configuration failed

ID

30503

Type

Event log

Subtype

System

Severity

Warning or notice

Message

  • msg=\"User <user_name> failed to restore the configuration from <IP_address>\"
  • msg=\"User <user_name> restored the <file_name> file <file_name> from management station\"

Meaning

The specified user failed to restore the system configuration.

System reset to factory settings

ID

30507

Type

Event log

Subtype

System

Severity

Critical

Message

msg=\"User <user_name> reset to the factory settings from <IP_address>\"

Meaning

The specified user reset the system to factory default settings.

Global setting changed

ID

30514

Type

Event log

Subtype

System

Severity

Notice

Message

  • msg=\"User <user_name> changed global setting from <old_value>\"
  • msg=\"User <user_name> changed hostname global setting to <new_value> from <old_value>\"
  • msg=\"User <user_name> changed timeout global setting to <new_value> from <old_value>\"
  • msg=\"User <user_name> changed detection-interval global setting to <new_value> from <old_value>\"
  • msg=\"User <user_name> changed fail_times global setting to <new_value> from <old_value>\"
  • msg=\"User <user_name> changed dst global setting to <new_value> from <old_value>\"

Meaning

  • The specified user changed a global setting.
  • The specified user changed the global host name setting.
  • The specified user changed the global timeout setting.
  • The specified user changed the global detection-interval setting.
  • The specified user changed the global failtime setting.
  • The specified user changed the global destination setting.

System configuration backed up

ID

30515

Type

Event log

Subtype

System

Severity

Alert, warning, or notice

Message

  • msg=\"User <user_name> backed up the configuration from <IP_address>\"
  • msg=\"User <user_name> backed up the configuration from <IP_address> to management station\"
  • msg=\"User <user_name> backed up the configuration from <IP_address> to flash disk\"
  • msg=\"Automatic configuration backup to flash disk succeeded\"
  • msg=\"User <user_name> backed up the configuration by SCP\"
  • msg=\"Configuration backed up to flash disk after system upgrading\"

Meaning

  • The specified user backed up the system configuration.
  • The specified user backed up the system configuration to the management station.
  • The specified user backed up the system to a flash drive.
  • The system configuration was successfully automatically backed up to a flash disk.
  • The specified user backed up the system configuration using the Secure Copy Protocol (SCP).
  • After the system was upgraded, the system configuration was backed up to a flash disk.

Configuration revision uploaded

ID

30516

Type

Event log

Subtype

System

Severity

Notice

Message

msg=\"User <user_name> upload the <file_name> from <IP_address> to flash disk\"

Meaning

The specified user uploaded the configuration revision to the flash disk.

Database revision deleted

ID

30518

Type

Event log

Subtype

System

Severity

Notice

Message

msg=\"<item>:<revision_number> has been deleted from revision data base\"

Meaning

The item has been deleted from the revision database.

Revision item deleted from flash disk

ID

30520

Type

Event log

Subtype

System

Severity

Notice

Message

msg=\"User <user_name> delete the <item> from <path> from flash disk\"

Meaning

The specified user deleted the revision item from the flash disk.

Command failed

ID

30522

Type

Event log

Subtype

System

Severity

Notice

Message

msg=\"Command failed: <user_name>. Return code <code_number>\"

Meaning

The command failed.

Adding a new entry failed

ID

30523

Type

Event log

Subtype

System

Severity

Notice

Message

msg=\"Adding new entry failed: vdom property limit has been reached when user <user_name> adds <property> from <IP _address>\"

Meaning

Adding a new entry failed because the VDOM property limit has been reached.

Failed to back up system configuration

ID

30524

Type

Event log

Subtype

System

Severity

Error or notice

Message

  • msg=\"User <user_name> failed to backup the configuration from <IP_address> to management station\"
  • msg=\"User <user_name> failed to backup the configuration from <IP_address> to flash disk\"
  • msg=\"Automatic configuration backup to flash disk failed(<IP_address>)\"
  • msg=\"Failed to backup configuration after system upgrading: <IP_address>\"

Meaning

  • The specified user failed to back up the system configuration to the management station.
  • The specified user failed to back up the system configuration to the flash disk.
  • Automatically backing up the system configuration to the flash disk failed.
  • After the system was upgraded, the system configuration backup failed.

Daemon started

ID

30700

Type

Event log

Subtype

System

Severity

Information

Message

msg=\"Daemon <daemon_name> started\"

Meaning

The specified daemon was started.

Daemon shut down

ID

30701

Type

Event log

Subtype

System

Severity

Information

Message

msg=\"Daemon <daemon_name> shut down\"

Meaning

The specified daemon was shut down.

Log information from the DHCP client module daemon

ID

30900

Type

Event log

Subtype

System

Severity

Varies

Message

msg=\"<log_entry>\"

Meaning

The DHCP client module daemon reported information for the log.

IP address too small

ID

30901

Type

Event log

Subtype

System

Severity

Warning

Message

msg=\"Address for requested options is too small. Dump all config: \n timeout: <time>\n init_interval: <initial_interval>\n retry_interval: <retry_interval>\n select_interval: <select_interval>\n reboot_timeout: <reboot_timeout>\n backoff_cutoff: <backoff_cutoff>\n arpcheck_timeout: <ARP_check_timeout>\n requested_lease: <requested_lease>\n requested_options address: <IP_address>\n\"

Meaning

The DHCP client module daemon reported crash information for the log because the IP address for the requested options is too small.

DHCP statistics

ID

31004

Type

Event log

Subtype

System

Severity

Information

Message

msg=\"<how_much_of_total_is_used>\"

Meaning

The system reports how much of DHCP-snooping binding database for the interface is used.

DHCP server used all of its leases

ID

31005

Type

Event log

Subtype

System

Severity

Warning

Message

msg=\"DHCP server <IP_address> has used up all of its leases\"

Meaning

The specified DHCP server has used all of its leases.

DHCP server used most of its leases

ID

31006

Type

Event log

Subtype

System

Severity

Warning

Message

msg=\"DHCP server <IP_address> has used up over 80%% of its leases\"

Meaning

The specified DHCP server has used over 80 percent of its leases.

DHCP server sends a DDNS add query

ID

31007

Type

Event log

Subtype

System

Severity

Information

Message

msg=\"DHCP server sends a DDNS add query\"

Meaning

The DHCP server is sending a DDNS add query.

DHCP server sends a DDNS delete query

ID

31008

Type

Event log

Subtype

System

Severity

Information

Message

msg=\"DHCP server sends a DDNS delete query\"

Meaning

The DHCP server is sending a DDNS delete query.

DHCP server blocked the DHCP client

ID

31009

Type

Event log

Subtype

System

Severity

Information

Message

msg=\"DHCP client is blocked by the DHCP server\"

Meaning

The DHCP server blocked the DHCP client.

DHCP server sends a DHCP acknowledgment

ID

31010

Type

Event log

Subtype

System

Severity

Information

Message

msg=\"DHCP server sends a DHCPACK\"

Meaning

The DHCP server sends a DHCP acknowledgment message

DHCP server receives a DHCP release

ID

31011

Type

Event log

Subtype

System

Severity

Information

Message

msg=\"DHCP server receives a DHCPRELEASE\"

Meaning

The DHCP server receives a DHCP release message.

Administrator logged in successfully

ID

32001

Type

Event log

Subtype

System

Severity

Information

Message

msg=\"Administrator <user_name> logged in successfully from <IP_address>\"

Meaning

An administrator logged in successfully.

Administrator failed to log in

ID

32002

Type

Event log

Subtype

System

Severity

Alert

Message

  • msg=\"Alarm testing\"
  • msg=\"Administrator <user_name> login failed from <IP_address>\"

Meaning

An administrator failed to log in.

Administrator logged out

ID

32003

Type

Event log

Subtype

System

Severity

Information

Message

msg=\"Administrator <user_name> <action> <status>\"

Meaning

An administrator logged out.

Admin login disabled because of login failures

ID

32008

Type

Event log

Subtype

System

Severity

Alert

Message

  • msg=\"Login disabled from IP <IP_address> for <number_of_seconds> seconds because of <number_of_attempts> bad attempts\"
  • msg=\"Administrator <user_name> disabled from logging in for <number_of_seconds> seconds because of <number_of_attempts> bad attempts\"

Meaning

The admin login was disabled because of too many failed attempts to log in.

Partitioning or formatting error

ID

33000

Type

Event log

Subtype

System

Severity

Warning

Message

msg=\"Partitioning or formatting error (<error_number>, <error_message>) partition=<partition_name> format=<type> label=<label_name>\"

Meaning

A partitioning error or formatting error occurred.

Log disk failure imminent

ID

33001

Type

Event log

Subtype

System

Severity

Critical

Message

msg=\"Log disk failure is imminent, logs should be backed up\"

Meaning

This S.M.A.R.T. (Self-Monitoring, Analysis and Reporting Technology) error is erroneous.

Lack of flash space

ID

33002

Type

Event log

Subtype

System

Severity

Critical

Message

Cannot store config due to short of flash space: require <number_of_blocks> blocks, only <number_of_blocks> free blocks left on flash disk

Meaning

The system configuration cannot be saved because of lack of flash space.

Disk formatting requested

ID

33003

Type

Event log

Subtype

System

Severity

Critical

Message

msg=\"User <user_name> requested to format <disk_name> disk from <IP_address>\"

Meaning

The specified user requested that the disk to be formatted.

Disk storage set up

ID

33004

Type

Event log

Subtype

System

Severity

Notice

Message

msg=\"Administrator <user_name> <action> disk storage <disk_name> from <IP_address>\"

Meaning

The administrator set up the disk storage.

Disk storage entry deleted

ID

33005

Type

Event log

Subtype

System

Severity

Notice

Message

msg=\"user <user_name> delete disk storage entry\"

Meaning

The administrator deleted an entry in disk storage.

Fan failure detected

ID

33100

Type

Event log

Subtype

System

Severity

Warning

Message

msg=\"FAN failure detected\"

Meaning

A fan failure was detected.

Fan tray not detected

ID

33101

Type

Event log

Subtype

System

Severity

Warning

Message

msg=\"FAN TRAY undetected\"

Meaning

The fan tray was not detected.

Fan tray detected

ID

33102

Type

Event log

Subtype

System

Severity

Warning

Message

msg=\"FAN TRAY detected\"

Meaning

The fan tray was detected.

Fan tray detection failed

ID

33103

Type

Event log

Subtype

System

Severity

Warning

Message

msg=\"FAN TRAY detected\"

Meaning

The fan tray detection failed.

Fan resumed working

ID

33104

Type

Event log

Subtype

System

Severity

Warning

Message

msg=\"FAN resumes\"

Meaning

The fan has resumed working.

Encryption failed

ID

33302

Type

Event log

Subtype

System

Severity

Alert

Message

msg=\"EVP encryption failed\"

Meaning

Encryption has failed.

Decryption failed

ID

33303

Type

Event log

Subtype

System

Severity

Alert

Message

msg=\"EVP decryption failed\"

Meaning

Decryption has failed.

Cannot extract FortiSwitch Private Key

ID

33304

Type

Event log

Subtype

System

Severity

Alert

Message

msg=\"Failed to extract FortiSwitch Private Key\"

Meaning

The FortiSwitch Private Key cannot be extracted.

FortiSwitch Cloud started or global time setting changed

ID

34000

Type

Event log

Subtype

System

Severity

Warning or notice

Message

  • msg=\"fsw_cloud service is started by user.\"
  • msg=\"User <user_name> changed time from <old_time> to <new_time>\"
  • msg=\"The ntp daemon step adjusted time from <old_time> to <new_time> (sync source: <NTP_server_IP_address>)\"

Meaning

  • The user started FortiSwitch Cloud.
  • The specified user changed the global time setting.
  • The NTP daemon changed the global time setting.

FortiSwitch Cloud stopped

ID

34001

Type

Event log

Subtype

System

Severity

Warning

Message

msg=\"fsw_cloud service is stopped by user.\"

Meaning

The user stopped FortiSwitch Cloud.

SSL connection to FortiSwitch Cloud established

ID

34002

Type

Event log

Subtype

System

Severity

Warning

Message

msg=\"SSL connection to cloud-manager ip=<IP_address>, port=<port_name> is established.\"

Meaning

The SSL connection to the FortiSwitch Cloud has been established.

SSL connection to FortiSwitch Cloud down

ID

34003

Type

Event log

Subtype

System

Severity

Warning

Message

msg=\"SSL connection to cloud-manager ip=<IP_address>, port=<port_name> is down (reason= <reason>).\"

Meaning

The SSL connection to FortiSwitch Cloud is down.

SSL connection to FortiSwitch Cloud not established

ID

34004

Type

Event log

Subtype

System

Severity

Warning

Message

msg=\"SSL connection to cloud-manager ip=<IP_address>, port=<port_number> not be established.\"

Meaning

The SSL connection to FortiSwitch Cloud cannot be established.

Packet capture stopped because of lack of storage

ID

34006

Type

Event log

Subtype

System

Severity

Warning

Message

msg=\"sniffer profile <profile_name> stopped due to storage error. (err=<error>).\"

Meaning

The packet capture stopped because there is not enough storage.

SSL connection being restarted

ID

34007

Type

Event log

Subtype

System

Severity

Warning

Message

msg=\"Restarting SSL connection, error= <error>. \"

Meaning

The SSL connection was restarted because of an error.

Corrupt MAC packet detected

ID

34200

Type

Event log

Subtype

System

Severity

Warning

Message

msg=\"Corrupted MAC packet detected\"

Meaning

A corrupt MAC packet was detected.

Firmware image restored

ID

34301

Type

Event log

Subtype

System

Severity

Critical

Message

msg=\"User <user_name> restored the image from <IP_address> (<old_version_number>,build <old_build_number>-> <new_version_number>,build <new_build_number>)\"

Meaning

The specified user restored the firmware image.

Firmware image failures

ID

34306

Type

Event log

Subtype

System

Severity

Critical or notice

Message

  • msg=\"Failed to backup firmware image for system <IP_address>. The reason is: <reason>\"
  • msg=\"User <user_name> loaded a wrong image from <IP_address>.\"
  • msg=\"User <user_name> loaded an image from <IP_address>, the new image has an invalid CC signature.\"
  • msg=\"User <user_name> loaded an image from <IP_address>, the new image has an invalid RSA signature.\"
  • msg=\"User <user_name> loaded an image from <IP_address>, the new image does have a valid RSA signature with new public key.\"
  • msg=\"User <user_name> loaded an image from <IP_address>, the new image does have a valid RSA signature.\"
  • msg=\"User <user_name> loaded an image from <IP_address>, System upgrade failed due to file operation failure\"
  • msg=\"User <user_name> updated the image from <IP_address> (<old_build_number>-> <new_build_number>)\"
  • msg=\"Failed to writing image to flash.\"

Meaning

  • Backing up the firmware image failed.
  • The user loaded the wrong firmware image.
  • The user loaded a firmware image with an invalid CC signature.
  • The user loaded a firmware image with an invalid RSA signature.
  • The user loaded a firmware image with a valid RSA signature with a new public key.
  • The user loaded a firmware image with a valid RSA signature.
  • The system upgrade failed because of a file operation failure.
  • The user updated the firmware image.
  • The system upgrade failed because the image could not be written to flash.

Firmware image backed up to flash disk

ID

34314

Type

Event log

Subtype

System

Severity

Notice

Message

msg=\"Firmware image backed up to flash disk for system <IP_address>\"

Meaning

The firmware image was backed up to a flash disk.

New local user added

ID

35000

Type

Event log

Subtype

System

Severity

Notice

Message

  • msg=\"User <user_name> added local user <local_user_name> from <IP_address>\"
  • msg=\"IP Conflict: conflict detected on system interface <interface_name> for IP address <IP_address>\"

Meaning

  • The specified user added a new local user.
  • An IP address conflict was detected on the specified system interface.

Setting changed for local user

ID

35001

Type

Event log

Subtype

System

Severity

Notice

Message

msg=\"User <user_name> changed local user <new_setting> setting from <old_setting>\"

Meaning

The specified user changed a setting for a local user.

Changes to static route or link monitor state

ID

35100

Type

Event log

Subtype

System

Severity

Critical or notice

Message

msg=\"<changes>\"

Meaning

Changes were made to a static route, or changes were made to the link monitor state.

RADIUS IPC error

ID

35200

Type

Event log

Subtype

System

Severity

Error

Message

msg=\"Unable to initialize RADIUS IPC (<IP_address>)\"

Meaning

The RADIUS IPC could not be initialized.

User viewed memory logs

ID

35213

Type

Event log

Subtype

System

Severity

Notice

Message

msg=\"User <user_name> has viewed the memory logs from <log>\"

Meaning

The specified user has viewed memory logs.

Log full

ID

35214

Type

Event log

Subtype

System

Severity

Warning or information

Message

msg=\"Memory <type> log is <percent> full\"

Meaning

The memory log is full.

Disk has rolled log maximum number of times

ID

35215

Type

Event log

Subtype

System

Severity

Emergency

Message

msg=\"Disk has rolled the max number of times.It will not roll logs again until deleting some of the old rolled logs.

Meaning

The disk has rolled the logs the maximum number of times. Some of the old rolled logs must be deleted before the disk will start rolling logs again.

System deleted uploaded logs

ID

35216

Type

Event log

Subtype

System

Severity

Information

Message

msg=\"System deleted logs that are uploaded\"

Meaning

The system deleted uploaded logs.

Log disk full

ID

35217

Type

Event log

Subtype

System

Severity

Emergency, warning, or information

Message

  • msg=\"Log disk is <percent> full.System will <action> when reaching <percent>.\"
  • msg=\"<log_name> is <percent> full.System will stop <log_name> logging.\"
  • msg=\"<log_name> is <percent> full.System will upload oldest 20%% logs.\"
  • msg=\"<log_name> is <percent> full.System will delete oldest 20%% uploaded logs, and upload another oldest 20%% un-upload logs.\"
  • msg=\"Log disk is <percent> full\"
  • msg=\"Disk logs exceed full final warning threshold. Deleted rolled log file <file_name>.
  • msg=\"Disk logs exceed full final warning threshold. Deleted rolled packet directory <directory_name>.
  • msg=\"Disk logs exceed full final warning threshold. Deleted rolled dlp-archive directory <directory_name>.

Meaning

  • The log disk is full. The system will stop logging when reaching the specified percentage.
  • The log disk is full. The system will stop logging.
  • The log disk is full. The system will upload the oldest logs.
  • The log disk is full. The system will delete the oldest uploaded logs and then upload the oldest logs that have not been uploaded.
  • The log disk is full.
  • The size of the disk logs has exceeded the final warning threshold. The rolled log file has been deleted.
  • The size of the disk logs has exceeded the final warning threshold. The rolled packet directory has been deleted.
  • The size of the disk logs has exceeded the final warning threshold. The rolled DLP archive directory has been deleted.

Log rotation

ID

35218

Type

Event log

Subtype

System

Severity

Notice

Message

msg=\"Disk log has rolled.\"

Meaning

The disk has rolled the logs.

System entered CC error mode

ID

35219

Type

Event log

Subtype

System

Severity

Emergency

Message

  • msg=\"CC error: Memory logs are full. System entered error mode.\"
  • msg=\"CC error: Disk logs are full. System entered error mode.\"
  • msg=\"CC error: Unknown. System entered error mode.\"

Meaning

The system is in CC error mode because the memory or disk logs are full.

System exited CC error mode

ID

35221

Type

Event log

Subtype

System

Severity

Information

Message

msg=\"System exiting out of error mode.\"

Meaning

The system is exiting CC error mode.

Logs cleared

ID

35222

Type

Event log

Subtype

System

Severity

Notice

Message

msg=\"User <user_name> has cleared logs () from <time_range>\"

Meaning

The specified user has cleared logs.

Rolled log files deleted

ID

35223

Type

Event log

Subtype

System

Severity

Notice

Message

msg=\"User <user_name> has deleted <number_of_logs> rolled <log_type> log file <file_name>(<IP_address>) from <IP_address>\"

Meaning

The specified user has deleted rolled log files.

User failed to view logs

ID

35227

Type

Event log

Subtype

System

Severity

Warning

Message

msg=\"User <user_name> failed to access the <log_type> logs from <IP_address>\"

Meaning

The specified user failed to access the logs.

Daily logging quota full

ID

35229

Type

Event log

Subtype

System

Severity

Alert

Message

msg=\" daily quota is reached.System stops logging until <number_of_seconds> sec later.\"

Meaning

The daily logging quota has been reached, and the system stops logging.

Logging file downloaded

ID

35230

Type

Event log

Subtype

System

Severity

Warning

Message

msg=\"<action> by user <user_name> via <interface>\"

Meaning

The specified user has used the GUI to download a logging file from the firewall.

Log backed up

ID

35231

Type

Event log

Subtype

System

Severity

Notice

Message

  • msg=\"User <user_name> backed up <log_type> memory log from <IP_address>\"
  • msg=\"User <user_name> backed up <log_type> log from <IP_address>\"

Meaning

The specified user has backed up the log.

Backing up all logs failed

ID

35232

Type

Event log

Subtype

System

Severity

Notice

Message

  • msg=\"User <user_name> failed to back up <log_type> memory log from <IP_address>\"
  • msg=\"User <user_name> failed to back up all memory logs (<log_types>) from <IP_address>\"
  • msg=\"User <user_name> failed to backup all the logs from <IP_address>\"

Meaning

The specified user failed to back up all logs.

All logs backed up

ID

35233

Type

Event log

Subtype

System

Severity

Notice

Message

  • msg=\"User <user_name> backed up all memory logs from <IP_address>\"
  • msg=\"User <user_name> backed up all the logs from <IP_address>\"

Meaning

The specified user backed up all logs.

Log backup failed

ID

35236

Type

Event log

Subtype

System

Severity

Notice

Message

msg=\"User <user_name> failed to backup <log_type> log from <IP_address>\"

Meaning

The specified user failed to back up a log.

Warning from monitor-and-alert daemon

ID

35242

Type

Event log

Subtype

System

Severity

Warning

Message

msg=\"<message_text>.\"

Meaning

The monitor-and-alert daemon sent a warning.

USB device inserted or removed

ID

35243

Type

Event log

Subtype

System

Severity

Notice

Message

  • msg=\"USB device inserted\

  • msg=\"USB device removed\"

Meaning

A USB device was inserted or removed.

Log test

ID

36000

Type

Event log

Subtype

System

Severity

Warning

Message

msg=\"user admin logged into the fw - <action>\"

Meaning

Log test

PSU changes to good state

ID

36100

Type

Event log

Subtype

System

Severity

Warning

Message

msg=\"<PSU> changes to good state\"

Meaning

The power supply unit (PSU) is now in a good state.

PSU changes to bad state

ID

36101

Type

Event log

Subtype

System

Severity

Warning

Message

msg=\"<PSU> changes to bad state\"

Meaning

The PSU is now in a bad state.

PSU connected

ID

36103

Type

Event log

Subtype

System

Severity

Warning

Message

msg=\"<PSU> connected\"

Meaning

The PSU is now connected.

PSU not connected

ID

36104

Type

Event log

Subtype

System

Severity

Warning

Message

msg=\"<PSU> not connected\"

Meaning

The PSU is now disconnected.

PSU 1 is down

ID

36106

Type

Event log

Subtype

System

Severity

Warning

Message

msg=\"PSU 1 is down\"

Meaning

PSU 1 is down.

PSU 1 is up

ID

36107

Type

Event log

Subtype

System

Severity

Warning

Message

msg=\"PSU 1 is up\"

Meaning

PSU 1 is up.

PSU 2 is down

ID

36108

Type

Event log

Subtype

System

Severity

Warning

Message

msg=\"PSU 2 is down\"

Meaning

PSU 2 is down.

PSU 2 is up

ID

36109

Type

Event log

Subtype

System

Severity

Warning

Message

msg=\"PSU 2 is up\"

Meaning

PSU 2 is up.

Corrupt MAC packet detected or negotiation failed

ID

36250

Type

Event log

Subtype

System

Severity

Error or warning

Message

  • msg=\"Corrupted MAC packet detected\"
  • msg=\"Negotiation failed: <IP_address>. Their offer: <IP_address>.\"
  • msg=\"Negotiation failed: <IP_address>.\"
  • msg=\"SSH server rekey\"

Meaning

  • A corrupt MAC packet was detected.
  • Negotiation failed.
  • The SSH server needs rekeying.

Fan tray status

ID

36300

Type

Event log

Subtype

System

Severity

Warning

Message

Varies

Meaning

The fan tray status is reported.

Alarm testing

ID

36350

Type

Event log

Subtype

System

Severity

Emergency

Message

msg=\"Alarm testing\"

Meaning

The alarm is being tested.

Learning-limit violations reset

ID

42000

Type

Event log

Subtype

System

Severity

Notice

Message

  • msg=\"Learn Limit Violation: Resetting violations for VLAN ID <VLAN_ID>.\"
  • msg=\"Learn Limit Violation: Resetting violations for interface <interface_name>.\"
  • msg=\"Learn Limit Violation: Resetting all violations.\"

Meaning

  • The learning-limit violation log was cleared for a specific interface.
  • The learning-limit violation log was cleared for a specific VLAN.
  • All learning-limit violation logs were cleared.

Learning-limit violations deleted

ID

42001

Type

Event log

Subtype

System

Severity

Notice

Message

  • msg=\"Learn Limit Violation: Clearing (deleting) violations for interface <interface_name>.\"
  • msg=\"Learn Limit Violation: Clearing (deleting) violations for VLAN ID <VLAN_ID>.\"
  • msg=\"Learn Limit Violation: Clearing (deleting) all violations.\"

Meaning

  • The learning-limit violations were deleted for a specific interface.
  • The learning-limit violations were deleted for a specific VLAN.
  • All learning-limit violations were deleted.

Learning-limit violation log enabled

ID

42002

Type

Event log

Subtype

System

Severity

Notice

Message

msg=\"Enabled learning limit violation records.\"

Meaning

The learning-limit violation log has been enabled.

Learning-limit violation log disabled

ID

42003

Type

Event log

Subtype

System

Severity

Notice

Message

msg=\"Disabled learning limit violation records.\"

Meaning

The learning-limit violation log has been disabled.

Learning limit exceeded

ID

42004

Type

Event log

Subtype

System

Severity

Notice

Message

  • msg=\"VLAN MAC learning limit exceeded, MAC <MAC_address> on VLAN <VLAN_ID> (RX Interface: <interface_name>).\"
  • msg=\"Interface MAC learning limit exceeded, MAC <MAC_address> on <interface_name> (Packet VID: <VLAN_ID>).\"

Meaning

The learning limit was exceeded on the specified VLAN or interface.

VM license file added

ID

42100

Type

Event log

Subtype

System

Severity

Critical

Message

msg=\"User <user_name> added VM license file.\"

Meaning

The specified user added a VM license file.

Failed to add VM license file

ID

42101

Type

Event log

Subtype

System

Severity

Critical

Message

msg=\"User <user_name> failed to add VM license file.\"

Meaning

The specified user failed to add a VM license file.

No more IP source guard entries can be added

ID

42200

Type

Event log

Subtype

System

Severity

Warning

Message

msg=\"Not install entry <IP_address> on <switch_interface> due to \"FULL\" error code.\"

Meaning

No more IP source guard entries can be added because the maximum number of entries has been added.

IP source-guard violations

ID

42201

Type

Event log

Subtype

System

Severity

Notice

Message

msg=\"Source guard violation, interface=<interface_name>, mac=<MAC_address>, ip=<IP_address>"

Meaning

Events that violate the IP source-guard settings have occured.

Cable-diagnostics messages

ID

42300

Type

Event log

Subtype

System

Severity

Notice

Message

  • msg=\"CABLE DIAGNOSE: A cable diagnostic is currently running on <port_name>, please try again in a few moments\"

  • msg=\"CABLE DIAGNOSE: A cable diagnostic must be performed on port which status configuration is up\"

  • msg=\"CABLE DIAGNOSE: Error diagnosing cable on port <port_name> (errno = <error_number>)\"

  • msg=\"CABLE DIAGNOSE: interface=<port_name> result=<result>\"

Meaning

  • Cable diagnostics can be run only on one port at a time.

  • You need to run cable diagnostics on an active port.

  • There was an error when running cable diagnostics.

  • The following results are for cable diagnostics onthe specified port.

System log messages

The log messages in this section are issues related to the overall operation of the FortiSwitch unit.

Alarm created

ID

30100

Type

Event log

Subtype

System

Severity

Alert

Message

msg=\"<alarm_ID>\"

Meaning

An alarm occurred.

Alarm acknowledged

ID

30101

Type

Event log

Subtype

System

Severity

Alert

Message

msg=\"<alarm_ID>\"

Meaning

The alarm was acknowledged.

Domain name in alert email cannot be resolved

ID

30150

Type

Event log

Subtype

System

Severity

Notice

Message

msg=\"Can't resolve the IP address of <alert_email_address_sender>\"

Meaning

The domain name of the sender of the alert email cannot be resolved.

FortiSwitch unit started

ID

30200

Type

Event log

Subtype

System

Severity

Information

Message

msg=\"FortiSwitch started <time>\"

Meaning

The FortiSwitch unit was started.

FortiSwitch unit rebooted or shut down

ID

30201

Type

Event log

Subtype

System

Severity

Critical

Message

  • msg=\"User <user_name> rebooted the device. The reason is 'restore configuration'\"
  • msg=\"User <user_name> rebooted the device from <IP_address>\"
  • msg=\"User <user_name> shutdown the device from <IP_address>\"

Meaning

The specified user rebooted or shut down the FortiSwitch unit.

Daily FortiSwitch unit restart

ID

30202

Type

Event log

Subtype

System

Severity

Critical

Message

msg=\"System will reboot due to scheduled daily restart.\"

Meaning

The FortiSwitch unit is being rebooted because it was scheduled to restart daily.

CA certificate will be automatically updated

ID

30300

Type

Event log

Subtype

System

Severity

Warning

Message

msg=\"CA certificate <certificate_name> will auto-update in <number_of_days> days.\"

Meaning

The certificate authority (CA) certificate will automatically update in the specified number of days.

Local certificate will be automatically regenerated

ID

30301

Type

Event log

Subtype

System

Severity

Warning

Message

msg=\"Local certificate <certificate_name> will auto-regenerate in <number_of_days> days.\"

Meaning

The local certificate will automatically regenerate in the specified number of days.

Certificate failed to automatically update

ID

30302

Type

Event log

Subtype

System

Severity

Error

Message

msg=\"<certificate_name>\"

Meaning

The certificate failed to automatically update.

Certificate failed to automatically regenerate

ID

30303

Type

Event log

Subtype

System

Severity

Error

Message

msg=\"<certificate_name>\"

Meaning

The certificate failed to automatically regenerate.

PKCS #12 certificate imported

ID

30304

Type

Event log

Subtype

System

Severity

Critical

Message

msg=\"User <user_name> imported the certificate from <path>\"

Meaning

The specified user imported a PKCS #12 certificate.

CRL update requested

ID

30306

Type

Event log

Subtype

System

Severity

Notice

Message

msg=\"User <user_name> requested a CRL update from <URL>\"

Meaning

The specified user requested an update for a certificate revocation list (CRL).

Power supply restored

ID

30400

Type

Event log

Subtype

System

Severity

Critical

Message

msg=\"Power supply <unit_ID> restore\"

Meaning

The specified power supply unit was restored.

Power supply failed

ID

30401

Type

Event log

Subtype

System

Severity

Critical

Message

msg=\"Power supply <unit_ID> failure\"

Meaning

The specified power supply unit failed.

System configuration changed

ID

30500

Type

Event log

Subtype

System

Severity

Alert

Message

  • msg=\"<user_name> made a change from <module>:<submodule>\"
  • msg=\"Configuration is changed in the admin session\"

Meaning

The specified user changed the system configuration.

System configuration changed using the GUI

ID

30501

Type

Event log

Subtype

System

Severity

Varies

Message

msg=\"User <user_name> made a change via <GUI>: <submodule>\"

Meaning

The specified user changed the system configuration from the GUI.

System configuration restored

ID

30502

Type

Event log

Subtype

System

Severity

Critical

Message

msg=\"User <user_name> restored the configuration from <IP_address>\"

Meaning

The specified user restored the system configuration.

Restoring the configuration failed

ID

30503

Type

Event log

Subtype

System

Severity

Warning or notice

Message

  • msg=\"User <user_name> failed to restore the configuration from <IP_address>\"
  • msg=\"User <user_name> restored the <file_name> file <file_name> from management station\"

Meaning

The specified user failed to restore the system configuration.

System reset to factory settings

ID

30507

Type

Event log

Subtype

System

Severity

Critical

Message

msg=\"User <user_name> reset to the factory settings from <IP_address>\"

Meaning

The specified user reset the system to factory default settings.

Global setting changed

ID

30514

Type

Event log

Subtype

System

Severity

Notice

Message

  • msg=\"User <user_name> changed global setting from <old_value>\"
  • msg=\"User <user_name> changed hostname global setting to <new_value> from <old_value>\"
  • msg=\"User <user_name> changed timeout global setting to <new_value> from <old_value>\"
  • msg=\"User <user_name> changed detection-interval global setting to <new_value> from <old_value>\"
  • msg=\"User <user_name> changed fail_times global setting to <new_value> from <old_value>\"
  • msg=\"User <user_name> changed dst global setting to <new_value> from <old_value>\"

Meaning

  • The specified user changed a global setting.
  • The specified user changed the global host name setting.
  • The specified user changed the global timeout setting.
  • The specified user changed the global detection-interval setting.
  • The specified user changed the global failtime setting.
  • The specified user changed the global destination setting.

System configuration backed up

ID

30515

Type

Event log

Subtype

System

Severity

Alert, warning, or notice

Message

  • msg=\"User <user_name> backed up the configuration from <IP_address>\"
  • msg=\"User <user_name> backed up the configuration from <IP_address> to management station\"
  • msg=\"User <user_name> backed up the configuration from <IP_address> to flash disk\"
  • msg=\"Automatic configuration backup to flash disk succeeded\"
  • msg=\"User <user_name> backed up the configuration by SCP\"
  • msg=\"Configuration backed up to flash disk after system upgrading\"

Meaning

  • The specified user backed up the system configuration.
  • The specified user backed up the system configuration to the management station.
  • The specified user backed up the system to a flash drive.
  • The system configuration was successfully automatically backed up to a flash disk.
  • The specified user backed up the system configuration using the Secure Copy Protocol (SCP).
  • After the system was upgraded, the system configuration was backed up to a flash disk.

Configuration revision uploaded

ID

30516

Type

Event log

Subtype

System

Severity

Notice

Message

msg=\"User <user_name> upload the <file_name> from <IP_address> to flash disk\"

Meaning

The specified user uploaded the configuration revision to the flash disk.

Database revision deleted

ID

30518

Type

Event log

Subtype

System

Severity

Notice

Message

msg=\"<item>:<revision_number> has been deleted from revision data base\"

Meaning

The item has been deleted from the revision database.

Revision item deleted from flash disk

ID

30520

Type

Event log

Subtype

System

Severity

Notice

Message

msg=\"User <user_name> delete the <item> from <path> from flash disk\"

Meaning

The specified user deleted the revision item from the flash disk.

Command failed

ID

30522

Type

Event log

Subtype

System

Severity

Notice

Message

msg=\"Command failed: <user_name>. Return code <code_number>\"

Meaning

The command failed.

Adding a new entry failed

ID

30523

Type

Event log

Subtype

System

Severity

Notice

Message

msg=\"Adding new entry failed: vdom property limit has been reached when user <user_name> adds <property> from <IP _address>\"

Meaning

Adding a new entry failed because the VDOM property limit has been reached.

Failed to back up system configuration

ID

30524

Type

Event log

Subtype

System

Severity

Error or notice

Message

  • msg=\"User <user_name> failed to backup the configuration from <IP_address> to management station\"
  • msg=\"User <user_name> failed to backup the configuration from <IP_address> to flash disk\"
  • msg=\"Automatic configuration backup to flash disk failed(<IP_address>)\"
  • msg=\"Failed to backup configuration after system upgrading: <IP_address>\"

Meaning

  • The specified user failed to back up the system configuration to the management station.
  • The specified user failed to back up the system configuration to the flash disk.
  • Automatically backing up the system configuration to the flash disk failed.
  • After the system was upgraded, the system configuration backup failed.

Daemon started

ID

30700

Type

Event log

Subtype

System

Severity

Information

Message

msg=\"Daemon <daemon_name> started\"

Meaning

The specified daemon was started.

Daemon shut down

ID

30701

Type

Event log

Subtype

System

Severity

Information

Message

msg=\"Daemon <daemon_name> shut down\"

Meaning

The specified daemon was shut down.

Log information from the DHCP client module daemon

ID

30900

Type

Event log

Subtype

System

Severity

Varies

Message

msg=\"<log_entry>\"

Meaning

The DHCP client module daemon reported information for the log.

IP address too small

ID

30901

Type

Event log

Subtype

System

Severity

Warning

Message

msg=\"Address for requested options is too small. Dump all config: \n timeout: <time>\n init_interval: <initial_interval>\n retry_interval: <retry_interval>\n select_interval: <select_interval>\n reboot_timeout: <reboot_timeout>\n backoff_cutoff: <backoff_cutoff>\n arpcheck_timeout: <ARP_check_timeout>\n requested_lease: <requested_lease>\n requested_options address: <IP_address>\n\"

Meaning

The DHCP client module daemon reported crash information for the log because the IP address for the requested options is too small.

DHCP statistics

ID

31004

Type

Event log

Subtype

System

Severity

Information

Message

msg=\"<how_much_of_total_is_used>\"

Meaning

The system reports how much of DHCP-snooping binding database for the interface is used.

DHCP server used all of its leases

ID

31005

Type

Event log

Subtype

System

Severity

Warning

Message

msg=\"DHCP server <IP_address> has used up all of its leases\"

Meaning

The specified DHCP server has used all of its leases.

DHCP server used most of its leases

ID

31006

Type

Event log

Subtype

System

Severity

Warning

Message

msg=\"DHCP server <IP_address> has used up over 80%% of its leases\"

Meaning

The specified DHCP server has used over 80 percent of its leases.

DHCP server sends a DDNS add query

ID

31007

Type

Event log

Subtype

System

Severity

Information

Message

msg=\"DHCP server sends a DDNS add query\"

Meaning

The DHCP server is sending a DDNS add query.

DHCP server sends a DDNS delete query

ID

31008

Type

Event log

Subtype

System

Severity

Information

Message

msg=\"DHCP server sends a DDNS delete query\"

Meaning

The DHCP server is sending a DDNS delete query.

DHCP server blocked the DHCP client

ID

31009

Type

Event log

Subtype

System

Severity

Information

Message

msg=\"DHCP client is blocked by the DHCP server\"

Meaning

The DHCP server blocked the DHCP client.

DHCP server sends a DHCP acknowledgment

ID

31010

Type

Event log

Subtype

System

Severity

Information

Message

msg=\"DHCP server sends a DHCPACK\"

Meaning

The DHCP server sends a DHCP acknowledgment message

DHCP server receives a DHCP release

ID

31011

Type

Event log

Subtype

System

Severity

Information

Message

msg=\"DHCP server receives a DHCPRELEASE\"

Meaning

The DHCP server receives a DHCP release message.

Administrator logged in successfully

ID

32001

Type

Event log

Subtype

System

Severity

Information

Message

msg=\"Administrator <user_name> logged in successfully from <IP_address>\"

Meaning

An administrator logged in successfully.

Administrator failed to log in

ID

32002

Type

Event log

Subtype

System

Severity

Alert

Message

  • msg=\"Alarm testing\"
  • msg=\"Administrator <user_name> login failed from <IP_address>\"

Meaning

An administrator failed to log in.

Administrator logged out

ID

32003

Type

Event log

Subtype

System

Severity

Information

Message

msg=\"Administrator <user_name> <action> <status>\"

Meaning

An administrator logged out.

Admin login disabled because of login failures

ID

32008

Type

Event log

Subtype

System

Severity

Alert

Message

  • msg=\"Login disabled from IP <IP_address> for <number_of_seconds> seconds because of <number_of_attempts> bad attempts\"
  • msg=\"Administrator <user_name> disabled from logging in for <number_of_seconds> seconds because of <number_of_attempts> bad attempts\"

Meaning

The admin login was disabled because of too many failed attempts to log in.

Partitioning or formatting error

ID

33000

Type

Event log

Subtype

System

Severity

Warning

Message

msg=\"Partitioning or formatting error (<error_number>, <error_message>) partition=<partition_name> format=<type> label=<label_name>\"

Meaning

A partitioning error or formatting error occurred.

Log disk failure imminent

ID

33001

Type

Event log

Subtype

System

Severity

Critical

Message

msg=\"Log disk failure is imminent, logs should be backed up\"

Meaning

This S.M.A.R.T. (Self-Monitoring, Analysis and Reporting Technology) error is erroneous.

Lack of flash space

ID

33002

Type

Event log

Subtype

System

Severity

Critical

Message

Cannot store config due to short of flash space: require <number_of_blocks> blocks, only <number_of_blocks> free blocks left on flash disk

Meaning

The system configuration cannot be saved because of lack of flash space.

Disk formatting requested

ID

33003

Type

Event log

Subtype

System

Severity

Critical

Message

msg=\"User <user_name> requested to format <disk_name> disk from <IP_address>\"

Meaning

The specified user requested that the disk to be formatted.

Disk storage set up

ID

33004

Type

Event log

Subtype

System

Severity

Notice

Message

msg=\"Administrator <user_name> <action> disk storage <disk_name> from <IP_address>\"

Meaning

The administrator set up the disk storage.

Disk storage entry deleted

ID

33005

Type

Event log

Subtype

System

Severity

Notice

Message

msg=\"user <user_name> delete disk storage entry\"

Meaning

The administrator deleted an entry in disk storage.

Fan failure detected

ID

33100

Type

Event log

Subtype

System

Severity

Warning

Message

msg=\"FAN failure detected\"

Meaning

A fan failure was detected.

Fan tray not detected

ID

33101

Type

Event log

Subtype

System

Severity

Warning

Message

msg=\"FAN TRAY undetected\"

Meaning

The fan tray was not detected.

Fan tray detected

ID

33102

Type

Event log

Subtype

System

Severity

Warning

Message

msg=\"FAN TRAY detected\"

Meaning

The fan tray was detected.

Fan tray detection failed

ID

33103

Type

Event log

Subtype

System

Severity

Warning

Message

msg=\"FAN TRAY detected\"

Meaning

The fan tray detection failed.

Fan resumed working

ID

33104

Type

Event log

Subtype

System

Severity

Warning

Message

msg=\"FAN resumes\"

Meaning

The fan has resumed working.

Encryption failed

ID

33302

Type

Event log

Subtype

System

Severity

Alert

Message

msg=\"EVP encryption failed\"

Meaning

Encryption has failed.

Decryption failed

ID

33303

Type

Event log

Subtype

System

Severity

Alert

Message

msg=\"EVP decryption failed\"

Meaning

Decryption has failed.

Cannot extract FortiSwitch Private Key

ID

33304

Type

Event log

Subtype

System

Severity

Alert

Message

msg=\"Failed to extract FortiSwitch Private Key\"

Meaning

The FortiSwitch Private Key cannot be extracted.

FortiSwitch Cloud started or global time setting changed

ID

34000

Type

Event log

Subtype

System

Severity

Warning or notice

Message

  • msg=\"fsw_cloud service is started by user.\"
  • msg=\"User <user_name> changed time from <old_time> to <new_time>\"
  • msg=\"The ntp daemon step adjusted time from <old_time> to <new_time> (sync source: <NTP_server_IP_address>)\"

Meaning

  • The user started FortiSwitch Cloud.
  • The specified user changed the global time setting.
  • The NTP daemon changed the global time setting.

FortiSwitch Cloud stopped

ID

34001

Type

Event log

Subtype

System

Severity

Warning

Message

msg=\"fsw_cloud service is stopped by user.\"

Meaning

The user stopped FortiSwitch Cloud.

SSL connection to FortiSwitch Cloud established

ID

34002

Type

Event log

Subtype

System

Severity

Warning

Message

msg=\"SSL connection to cloud-manager ip=<IP_address>, port=<port_name> is established.\"

Meaning

The SSL connection to the FortiSwitch Cloud has been established.

SSL connection to FortiSwitch Cloud down

ID

34003

Type

Event log

Subtype

System

Severity

Warning

Message

msg=\"SSL connection to cloud-manager ip=<IP_address>, port=<port_name> is down (reason= <reason>).\"

Meaning

The SSL connection to FortiSwitch Cloud is down.

SSL connection to FortiSwitch Cloud not established

ID

34004

Type

Event log

Subtype

System

Severity

Warning

Message

msg=\"SSL connection to cloud-manager ip=<IP_address>, port=<port_number> not be established.\"

Meaning

The SSL connection to FortiSwitch Cloud cannot be established.

Packet capture stopped because of lack of storage

ID

34006

Type

Event log

Subtype

System

Severity

Warning

Message

msg=\"sniffer profile <profile_name> stopped due to storage error. (err=<error>).\"

Meaning

The packet capture stopped because there is not enough storage.

SSL connection being restarted

ID

34007

Type

Event log

Subtype

System

Severity

Warning

Message

msg=\"Restarting SSL connection, error= <error>. \"

Meaning

The SSL connection was restarted because of an error.

Corrupt MAC packet detected

ID

34200

Type

Event log

Subtype

System

Severity

Warning

Message

msg=\"Corrupted MAC packet detected\"

Meaning

A corrupt MAC packet was detected.

Firmware image restored

ID

34301

Type

Event log

Subtype

System

Severity

Critical

Message

msg=\"User <user_name> restored the image from <IP_address> (<old_version_number>,build <old_build_number>-> <new_version_number>,build <new_build_number>)\"

Meaning

The specified user restored the firmware image.

Firmware image failures

ID

34306

Type

Event log

Subtype

System

Severity

Critical or notice

Message

  • msg=\"Failed to backup firmware image for system <IP_address>. The reason is: <reason>\"
  • msg=\"User <user_name> loaded a wrong image from <IP_address>.\"
  • msg=\"User <user_name> loaded an image from <IP_address>, the new image has an invalid CC signature.\"
  • msg=\"User <user_name> loaded an image from <IP_address>, the new image has an invalid RSA signature.\"
  • msg=\"User <user_name> loaded an image from <IP_address>, the new image does have a valid RSA signature with new public key.\"
  • msg=\"User <user_name> loaded an image from <IP_address>, the new image does have a valid RSA signature.\"
  • msg=\"User <user_name> loaded an image from <IP_address>, System upgrade failed due to file operation failure\"
  • msg=\"User <user_name> updated the image from <IP_address> (<old_build_number>-> <new_build_number>)\"
  • msg=\"Failed to writing image to flash.\"

Meaning

  • Backing up the firmware image failed.
  • The user loaded the wrong firmware image.
  • The user loaded a firmware image with an invalid CC signature.
  • The user loaded a firmware image with an invalid RSA signature.
  • The user loaded a firmware image with a valid RSA signature with a new public key.
  • The user loaded a firmware image with a valid RSA signature.
  • The system upgrade failed because of a file operation failure.
  • The user updated the firmware image.
  • The system upgrade failed because the image could not be written to flash.

Firmware image backed up to flash disk

ID

34314

Type

Event log

Subtype

System

Severity

Notice

Message

msg=\"Firmware image backed up to flash disk for system <IP_address>\"

Meaning

The firmware image was backed up to a flash disk.

New local user added

ID

35000

Type

Event log

Subtype

System

Severity

Notice

Message

  • msg=\"User <user_name> added local user <local_user_name> from <IP_address>\"
  • msg=\"IP Conflict: conflict detected on system interface <interface_name> for IP address <IP_address>\"

Meaning

  • The specified user added a new local user.
  • An IP address conflict was detected on the specified system interface.

Setting changed for local user

ID

35001

Type

Event log

Subtype

System

Severity

Notice

Message

msg=\"User <user_name> changed local user <new_setting> setting from <old_setting>\"

Meaning

The specified user changed a setting for a local user.

Changes to static route or link monitor state

ID

35100

Type

Event log

Subtype

System

Severity

Critical or notice

Message

msg=\"<changes>\"

Meaning

Changes were made to a static route, or changes were made to the link monitor state.

RADIUS IPC error

ID

35200

Type

Event log

Subtype

System

Severity

Error

Message

msg=\"Unable to initialize RADIUS IPC (<IP_address>)\"

Meaning

The RADIUS IPC could not be initialized.

User viewed memory logs

ID

35213

Type

Event log

Subtype

System

Severity

Notice

Message

msg=\"User <user_name> has viewed the memory logs from <log>\"

Meaning

The specified user has viewed memory logs.

Log full

ID

35214

Type

Event log

Subtype

System

Severity

Warning or information

Message

msg=\"Memory <type> log is <percent> full\"

Meaning

The memory log is full.

Disk has rolled log maximum number of times

ID

35215

Type

Event log

Subtype

System

Severity

Emergency

Message

msg=\"Disk has rolled the max number of times.It will not roll logs again until deleting some of the old rolled logs.

Meaning

The disk has rolled the logs the maximum number of times. Some of the old rolled logs must be deleted before the disk will start rolling logs again.

System deleted uploaded logs

ID

35216

Type

Event log

Subtype

System

Severity

Information

Message

msg=\"System deleted logs that are uploaded\"

Meaning

The system deleted uploaded logs.

Log disk full

ID

35217

Type

Event log

Subtype

System

Severity

Emergency, warning, or information

Message

  • msg=\"Log disk is <percent> full.System will <action> when reaching <percent>.\"
  • msg=\"<log_name> is <percent> full.System will stop <log_name> logging.\"
  • msg=\"<log_name> is <percent> full.System will upload oldest 20%% logs.\"
  • msg=\"<log_name> is <percent> full.System will delete oldest 20%% uploaded logs, and upload another oldest 20%% un-upload logs.\"
  • msg=\"Log disk is <percent> full\"
  • msg=\"Disk logs exceed full final warning threshold. Deleted rolled log file <file_name>.
  • msg=\"Disk logs exceed full final warning threshold. Deleted rolled packet directory <directory_name>.
  • msg=\"Disk logs exceed full final warning threshold. Deleted rolled dlp-archive directory <directory_name>.

Meaning

  • The log disk is full. The system will stop logging when reaching the specified percentage.
  • The log disk is full. The system will stop logging.
  • The log disk is full. The system will upload the oldest logs.
  • The log disk is full. The system will delete the oldest uploaded logs and then upload the oldest logs that have not been uploaded.
  • The log disk is full.
  • The size of the disk logs has exceeded the final warning threshold. The rolled log file has been deleted.
  • The size of the disk logs has exceeded the final warning threshold. The rolled packet directory has been deleted.
  • The size of the disk logs has exceeded the final warning threshold. The rolled DLP archive directory has been deleted.

Log rotation

ID

35218

Type

Event log

Subtype

System

Severity

Notice

Message

msg=\"Disk log has rolled.\"

Meaning

The disk has rolled the logs.

System entered CC error mode

ID

35219

Type

Event log

Subtype

System

Severity

Emergency

Message

  • msg=\"CC error: Memory logs are full. System entered error mode.\"
  • msg=\"CC error: Disk logs are full. System entered error mode.\"
  • msg=\"CC error: Unknown. System entered error mode.\"

Meaning

The system is in CC error mode because the memory or disk logs are full.

System exited CC error mode

ID

35221

Type

Event log

Subtype

System

Severity

Information

Message

msg=\"System exiting out of error mode.\"

Meaning

The system is exiting CC error mode.

Logs cleared

ID

35222

Type

Event log

Subtype

System

Severity

Notice

Message

msg=\"User <user_name> has cleared logs () from <time_range>\"

Meaning

The specified user has cleared logs.

Rolled log files deleted

ID

35223

Type

Event log

Subtype

System

Severity

Notice

Message

msg=\"User <user_name> has deleted <number_of_logs> rolled <log_type> log file <file_name>(<IP_address>) from <IP_address>\"

Meaning

The specified user has deleted rolled log files.

User failed to view logs

ID

35227

Type

Event log

Subtype

System

Severity

Warning

Message

msg=\"User <user_name> failed to access the <log_type> logs from <IP_address>\"

Meaning

The specified user failed to access the logs.

Daily logging quota full

ID

35229

Type

Event log

Subtype

System

Severity

Alert

Message

msg=\" daily quota is reached.System stops logging until <number_of_seconds> sec later.\"

Meaning

The daily logging quota has been reached, and the system stops logging.

Logging file downloaded

ID

35230

Type

Event log

Subtype

System

Severity

Warning

Message

msg=\"<action> by user <user_name> via <interface>\"

Meaning

The specified user has used the GUI to download a logging file from the firewall.

Log backed up

ID

35231

Type

Event log

Subtype

System

Severity

Notice

Message

  • msg=\"User <user_name> backed up <log_type> memory log from <IP_address>\"
  • msg=\"User <user_name> backed up <log_type> log from <IP_address>\"

Meaning

The specified user has backed up the log.

Backing up all logs failed

ID

35232

Type

Event log

Subtype

System

Severity

Notice

Message

  • msg=\"User <user_name> failed to back up <log_type> memory log from <IP_address>\"
  • msg=\"User <user_name> failed to back up all memory logs (<log_types>) from <IP_address>\"
  • msg=\"User <user_name> failed to backup all the logs from <IP_address>\"

Meaning

The specified user failed to back up all logs.

All logs backed up

ID

35233

Type

Event log

Subtype

System

Severity

Notice

Message

  • msg=\"User <user_name> backed up all memory logs from <IP_address>\"
  • msg=\"User <user_name> backed up all the logs from <IP_address>\"

Meaning

The specified user backed up all logs.

Log backup failed

ID

35236

Type

Event log

Subtype

System

Severity

Notice

Message

msg=\"User <user_name> failed to backup <log_type> log from <IP_address>\"

Meaning

The specified user failed to back up a log.

Warning from monitor-and-alert daemon

ID

35242

Type

Event log

Subtype

System

Severity

Warning

Message

msg=\"<message_text>.\"

Meaning

The monitor-and-alert daemon sent a warning.

USB device inserted or removed

ID

35243

Type

Event log

Subtype

System

Severity

Notice

Message

  • msg=\"USB device inserted\

  • msg=\"USB device removed\"

Meaning

A USB device was inserted or removed.

Log test

ID

36000

Type

Event log

Subtype

System

Severity

Warning

Message

msg=\"user admin logged into the fw - <action>\"

Meaning

Log test

PSU changes to good state

ID

36100

Type

Event log

Subtype

System

Severity

Warning

Message

msg=\"<PSU> changes to good state\"

Meaning

The power supply unit (PSU) is now in a good state.

PSU changes to bad state

ID

36101

Type

Event log

Subtype

System

Severity

Warning

Message

msg=\"<PSU> changes to bad state\"

Meaning

The PSU is now in a bad state.

PSU connected

ID

36103

Type

Event log

Subtype

System

Severity

Warning

Message

msg=\"<PSU> connected\"

Meaning

The PSU is now connected.

PSU not connected

ID

36104

Type

Event log

Subtype

System

Severity

Warning

Message

msg=\"<PSU> not connected\"

Meaning

The PSU is now disconnected.

PSU 1 is down

ID

36106

Type

Event log

Subtype

System

Severity

Warning

Message

msg=\"PSU 1 is down\"

Meaning

PSU 1 is down.

PSU 1 is up

ID

36107

Type

Event log

Subtype

System

Severity

Warning

Message

msg=\"PSU 1 is up\"

Meaning

PSU 1 is up.

PSU 2 is down

ID

36108

Type

Event log

Subtype

System

Severity

Warning

Message

msg=\"PSU 2 is down\"

Meaning

PSU 2 is down.

PSU 2 is up

ID

36109

Type

Event log

Subtype

System

Severity

Warning

Message

msg=\"PSU 2 is up\"

Meaning

PSU 2 is up.

Corrupt MAC packet detected or negotiation failed

ID

36250

Type

Event log

Subtype

System

Severity

Error or warning

Message

  • msg=\"Corrupted MAC packet detected\"
  • msg=\"Negotiation failed: <IP_address>. Their offer: <IP_address>.\"
  • msg=\"Negotiation failed: <IP_address>.\"
  • msg=\"SSH server rekey\"

Meaning

  • A corrupt MAC packet was detected.
  • Negotiation failed.
  • The SSH server needs rekeying.

Fan tray status

ID

36300

Type

Event log

Subtype

System

Severity

Warning

Message

Varies

Meaning

The fan tray status is reported.

Alarm testing

ID

36350

Type

Event log

Subtype

System

Severity

Emergency

Message

msg=\"Alarm testing\"

Meaning

The alarm is being tested.

Learning-limit violations reset

ID

42000

Type

Event log

Subtype

System

Severity

Notice

Message

  • msg=\"Learn Limit Violation: Resetting violations for VLAN ID <VLAN_ID>.\"
  • msg=\"Learn Limit Violation: Resetting violations for interface <interface_name>.\"
  • msg=\"Learn Limit Violation: Resetting all violations.\"

Meaning

  • The learning-limit violation log was cleared for a specific interface.
  • The learning-limit violation log was cleared for a specific VLAN.
  • All learning-limit violation logs were cleared.

Learning-limit violations deleted

ID

42001

Type

Event log

Subtype

System

Severity

Notice

Message

  • msg=\"Learn Limit Violation: Clearing (deleting) violations for interface <interface_name>.\"
  • msg=\"Learn Limit Violation: Clearing (deleting) violations for VLAN ID <VLAN_ID>.\"
  • msg=\"Learn Limit Violation: Clearing (deleting) all violations.\"

Meaning

  • The learning-limit violations were deleted for a specific interface.
  • The learning-limit violations were deleted for a specific VLAN.
  • All learning-limit violations were deleted.

Learning-limit violation log enabled

ID

42002

Type

Event log

Subtype

System

Severity

Notice

Message

msg=\"Enabled learning limit violation records.\"

Meaning

The learning-limit violation log has been enabled.

Learning-limit violation log disabled

ID

42003

Type

Event log

Subtype

System

Severity

Notice

Message

msg=\"Disabled learning limit violation records.\"

Meaning

The learning-limit violation log has been disabled.

Learning limit exceeded

ID

42004

Type

Event log

Subtype

System

Severity

Notice

Message

  • msg=\"VLAN MAC learning limit exceeded, MAC <MAC_address> on VLAN <VLAN_ID> (RX Interface: <interface_name>).\"
  • msg=\"Interface MAC learning limit exceeded, MAC <MAC_address> on <interface_name> (Packet VID: <VLAN_ID>).\"

Meaning

The learning limit was exceeded on the specified VLAN or interface.

VM license file added

ID

42100

Type

Event log

Subtype

System

Severity

Critical

Message

msg=\"User <user_name> added VM license file.\"

Meaning

The specified user added a VM license file.

Failed to add VM license file

ID

42101

Type

Event log

Subtype

System

Severity

Critical

Message

msg=\"User <user_name> failed to add VM license file.\"

Meaning

The specified user failed to add a VM license file.

No more IP source guard entries can be added

ID

42200

Type

Event log

Subtype

System

Severity

Warning

Message

msg=\"Not install entry <IP_address> on <switch_interface> due to \"FULL\" error code.\"

Meaning

No more IP source guard entries can be added because the maximum number of entries has been added.

IP source-guard violations

ID

42201

Type

Event log

Subtype

System

Severity

Notice

Message

msg=\"Source guard violation, interface=<interface_name>, mac=<MAC_address>, ip=<IP_address>"

Meaning

Events that violate the IP source-guard settings have occured.

Cable-diagnostics messages

ID

42300

Type

Event log

Subtype

System

Severity

Notice

Message

  • msg=\"CABLE DIAGNOSE: A cable diagnostic is currently running on <port_name>, please try again in a few moments\"

  • msg=\"CABLE DIAGNOSE: A cable diagnostic must be performed on port which status configuration is up\"

  • msg=\"CABLE DIAGNOSE: Error diagnosing cable on port <port_name> (errno = <error_number>)\"

  • msg=\"CABLE DIAGNOSE: interface=<port_name> result=<result>\"

Meaning

  • Cable diagnostics can be run only on one port at a time.

  • You need to run cable diagnostics on an active port.

  • There was an error when running cable diagnostics.

  • The following results are for cable diagnostics onthe specified port.