Fortinet black logo

Administration Guide

Collecting core/coredump files and logs

Collecting core/coredump files and logs

As stated in above section, core/coredump files formatted as core-* and coredump-* can be downloaded from System > Maintenance > Backup & Restore > GUI File Download/Upload.

It’s also necessary to collect some other logs that can help to analyze the coredump causes.

Please collect these logs:

  1. Download the archived debug log with one-click button (System > Maintenance > Debug > Download).

    The archive file includes most logs under /var/log/debug/, /var/log/gui_upload and some other system directories.

    Please refer to Customizing&downloading debug logs.

    Please remember that you have to enable System > Config > Feature Visibility > Debug at first.

  2. Download core/coredump files and other logs that are not archived in the debug log.

    Core and coredump files are usually very big, so they are not included in the one-click debug log file.

    Some other bugs such as complete dmesg logs and ha_event_log are not included at earlier builds especially when they’re added by new features, so it’s better for you to check the one-click downloaded debug file and see which logs are not included.

    For these logs, you can download via System > Maintenance > Backup & Restore > GUI File Download/Upload:

    Accordingly, these logs are stored at the following directories. Sometimes the support team may also require you to copy other log files to /var/log/gui_upload, then you can download them from GUI.

    /var/log/gui_upload/core-*

    /var/log/gui_upload/coredump-*

    /var/log/dmesg/: #You can archive this directory first by executing “tar czf /var/log/gui_upload/dmesg.tar.gz /var/log/dmesg/”

    ha_event_log: including very detailed HA init, switch, config-sync, heartbeat logs

    Note: After 7.0.1 release, /var/log/dmesg/* & ha_event_log are already included in the archived debug log, so you do not need to download them separately.

  3. Download core/coredump files (named as core-* and coredump-*), detailed dmesg logs, and other logs (not archived in the debug log, but can be seen directly in GUI File Download/Upload).

    It’s better to check the files in the one-click downloaded debug file to see which logs are not included, then just download them to avoid duplicate download.

    /var/log/gui_upload/core-*

    /var/log/gui_upload/coredump-*

    /var/log/dmesg/: #You can archive this directory first by executing “tar czf /var/log/gui_upload/dmesg.tar.gz /var/log/dmesg/”

    ha_event_log: including very detailed HA init, switch, config-sync, heartbeat logs

  4. Download Event logs from Log&Report > Log Access > Download, selecting the corresponding time period;

    Note:

    1. In 6.4.0, core and coredump files will be achieved and put a copy into /var/log/debug/tmp when one clicks to download the debug log (System > Maintenance > Debug > Download Log),
    2. In 6.4.1, 7.0.0 and later releases, all kernel core and coredump files will not be achieved and can be only downloaded from /var/log/gui_upload. Please refer to the screenshot below, one can also compress a specific file before download it:

  5. Provide core/coredump files, dmesg and other necessary logs to the support team for further investigation.

Usually you only needs to collect core/coredump, dmesg and other logs and provide them to support team for further analysis.

Collecting core/coredump files and logs

As stated in above section, core/coredump files formatted as core-* and coredump-* can be downloaded from System > Maintenance > Backup & Restore > GUI File Download/Upload.

It’s also necessary to collect some other logs that can help to analyze the coredump causes.

Please collect these logs:

  1. Download the archived debug log with one-click button (System > Maintenance > Debug > Download).

    The archive file includes most logs under /var/log/debug/, /var/log/gui_upload and some other system directories.

    Please refer to Customizing&downloading debug logs.

    Please remember that you have to enable System > Config > Feature Visibility > Debug at first.

  2. Download core/coredump files and other logs that are not archived in the debug log.

    Core and coredump files are usually very big, so they are not included in the one-click debug log file.

    Some other bugs such as complete dmesg logs and ha_event_log are not included at earlier builds especially when they’re added by new features, so it’s better for you to check the one-click downloaded debug file and see which logs are not included.

    For these logs, you can download via System > Maintenance > Backup & Restore > GUI File Download/Upload:

    Accordingly, these logs are stored at the following directories. Sometimes the support team may also require you to copy other log files to /var/log/gui_upload, then you can download them from GUI.

    /var/log/gui_upload/core-*

    /var/log/gui_upload/coredump-*

    /var/log/dmesg/: #You can archive this directory first by executing “tar czf /var/log/gui_upload/dmesg.tar.gz /var/log/dmesg/”

    ha_event_log: including very detailed HA init, switch, config-sync, heartbeat logs

    Note: After 7.0.1 release, /var/log/dmesg/* & ha_event_log are already included in the archived debug log, so you do not need to download them separately.

  3. Download core/coredump files (named as core-* and coredump-*), detailed dmesg logs, and other logs (not archived in the debug log, but can be seen directly in GUI File Download/Upload).

    It’s better to check the files in the one-click downloaded debug file to see which logs are not included, then just download them to avoid duplicate download.

    /var/log/gui_upload/core-*

    /var/log/gui_upload/coredump-*

    /var/log/dmesg/: #You can archive this directory first by executing “tar czf /var/log/gui_upload/dmesg.tar.gz /var/log/dmesg/”

    ha_event_log: including very detailed HA init, switch, config-sync, heartbeat logs

  4. Download Event logs from Log&Report > Log Access > Download, selecting the corresponding time period;

    Note:

    1. In 6.4.0, core and coredump files will be achieved and put a copy into /var/log/debug/tmp when one clicks to download the debug log (System > Maintenance > Debug > Download Log),
    2. In 6.4.1, 7.0.0 and later releases, all kernel core and coredump files will not be achieved and can be only downloaded from /var/log/gui_upload. Please refer to the screenshot below, one can also compress a specific file before download it:

  5. Provide core/coredump files, dmesg and other necessary logs to the support team for further investigation.

Usually you only needs to collect core/coredump, dmesg and other logs and provide them to support team for further analysis.