debug flow filter
Use this command to apply filter conditions that limit flow trace debug output to relevant traffic only. This reduces debug noise and improves troubleshooting efficiency, especially in high-traffic or multi-tenant environments.
Before you will be able to see any debug logs, you must first enable debug log output using the command debug.
You can filter flow trace output based on:
-
Source or destination IP address
-
Server policy name
-
Content routing policy name (Reverse Proxy mode only)
-
Flow detail, HTTP detail, or module detail level
Multiple filters can be combined; all conditions are evaluated in logical AND.
To use this command, your administrator account’s access control profile requires only r permission in any profile area. For details, see Permissions.
Syntax
diagnose debug enable
diagnose debug flow trace start
diagnose debug flow filter flow-detail <verbosity-level_int>
diagnose debug flow filter debug flow filter
diagnose debug flow filter module-detail {x-forworded-for | ip-list | ip-reputation | quarant-ip | known-engine | geo-block | ...| url-rewriting} <verbosity-level_int>
diagnose debug flow filter debug flow filter
diagnose debug flow filter debug flow filter
diagnose debug flow filter policy <policy_name>
diagnose debug flow filter content-routing-policy <policy_name>
diagnose debug flow trace stop
|
flow-detail <verbosity-level_int>
|
Specify the verbosity level to output to the CLI display after the command executes.
The valid range is 0–7, where 0 disables debug logs and 7 generates the most verbose logging.
If you omit the number, the CLI displays the current verbosity level.
The default verbosity-level value for flow-detail is 1.
|
1
|
|
http-detail <verbosity-level_int>
|
Specify the verbosity level to output to the CLI display after the command executes.
The valid range is 0–7, where 0 disables debug logs and 7 generates the most verbose logging.
If you omit the number, the CLI displays the current verbosity level.
The default verbosity-level value for http-detail is 0, which means "disabled".
|
0
|
|
module-detail {x-forworded-for | ip-list | ip-reputation | quarant-ip | known-engine | geo-block | ...| url-rewriting} <verbosity-level_int>
|
Select the name of module that needs to be traced (separated by space).
Enter diagnose debug flow filter module-detail ? to display all the available module names if you don't know the exact name of the module.
The default verbosity-level value for module-detail is 0, which means "disabled".
|
No default.
|
|
client-ip <source_ipv4 | source_ipv6>
|
Enter the source (SRC) IP address of connections. This will generate only packet flow debug log messages involving that source IP address.
Note: This filter operates at the IP layer, not the HTTP layer.
If a load balancer or other web proxy is deployed in front of FortiWeb, and therefore all connections for HTTP requests appear to originate from this IP address, configuring this filter will have no effect.
Similarly, if multiple clients share an Internet connection via NAT or explicit web proxy, configuring this filter will only isolate connections that share this IP address. It will not be able to filter out a single client based on individual HTTP sessions from that IP.
|
No default. |
|
server-ip <destination_ipv4 | destination_ipv6>
|
Enter the destination (DST) IP address of the connection, either the:
- Virtual server on FortiWeb (if FortiWeb is operating in Reverse Proxy mode)
- Protected web server on the back end (all other operation modes)
This will generate only packet flow debug log messages involving that server IP address.
|
No default. |
|
policy <policy_name>
|
Enter the name of the server policy to filter out the connections that match the Network Configuration in the policy.
|
No default.
|
|
content-routing-policy <policy_name>
|
Filters flows by content routing policy name. Available in Reverse Proxy mode. Matching occurs during the first HTTP request of the session. Once matched, the entire session is marked for debug output.
|
No default.
|
Examples
Flow trace with IP filters and flow detail level:
diagnose debug enable
diagnose debug flow filter flow-detail 2
diagnose debug flow filter client-ip 192.0.2.10
diagnose debug flow filter server-ip 203.0.113.5
diagnose debug flow trace start
HTTP flow trace by server policy:
diagnose debug enable
diagnose debug flow filter policy policy_1
diagnose debug flow filter http-detail 3
diagnose debug flow trace start
Trace flows matching a specific content routing policy:
diagnose debug enable
diagnose debug flow filter content-routing-policy root.policy
diagnose debug flow trace start
Related topics
