policy
Use this command to view the process ID, live sessions, and traffic statistics associated with a server policy.
To use this command, your administrator account’s access control profile must have at least r permission to the sysgrp area. For details, see Permissions.
Syntax
diagnose policy pserver [list "<policy_name>"]
diagnose policy session [list "<policy_name>"]
diagnose policy traffic [list "<policy_name>"]
diagnose policy period-blockip [list "<policy_name>"]
diagnose policy period-blockip [delete "<policy_name>"]{ipv4 | ipv6}
diagnose policy total-session [list "<session_number>"]
diagnose policy total-traffic http [list "<session_number>"]
diagnose policy "<policy_name>"
diagnose policy jwks-cache {list | delete}
diagnose policy shared-waf-instance-on-non-CR-dmodeWAF_SERVER_PROTECTION_RULE <adom-name> <profile-name>
diagnose policy set shared-waf-instance-mode-on-non-CR-dmode {enable | disable}
|
pserver [list "<policy_name>"]
|
Displays the status of physical servers covered by the policy. |
No default. |
|
session [list "<policy_name>"]
|
Displays IP session information for TCP and UDP connections. |
No default. |
|
traffic [list "<policy_name>"]
|
Displays traffic throughput (bandwidth usage) information. |
No default. |
|
period-blockip [list "<policy_name>"]
|
Displays client IP addresses whose requests are temporarily blocked because the client violated a rule in the specified policy with an Action value of Period Block. |
No default. |
|
period-blockip [delete "<policy_name>"]{ipv4 | ipv6}
|
Unblocks the specified client IP address that FortiWeb has blocked because it violated a rule in the specified policy with an Action value of Period Block. (FortiWeb can still block the address because it violates a rule in a different policy.) |
No default. |
|
total-session [list "<session_number>"]
|
Displays the total number of the current connections.
|
No default.
|
|
total-traffic http [list "<session_number>"]
|
Displays the total throughput in HTTP level.
This statistics from CLI only includes HTTP payload, does not include L2 & L3 headers
|
No default.
|
|
"<policy_name>"
|
Enter the name of an existing server policy. |
No default. |
|
jwks-cache {list | delete}
|
Use the diagnose policy jwks-cache command to inspect or clear the local cache of public keys retrieved from JWKS (JSON Web Key Set) endpoints. This cache enables FortiWeb to perform efficient JWT signature verification for mobile API clients using dynamically fetched keys.
|
No default.
|
|
shared-waf-instance-on-non-CR-dmodeWAF_SERVER_PROTECTION_RULE <adom-name> <profile-name>
|
Displays internal state and reference counters for the specified WAF module profile. Use this command to check whether the profile is operating in shared-instance mode and how many policies are currently referencing it.
Parameters:
-
WAF_SERVER_PROTECTION_RULE: Currently, obnly the WAF_SERVER_PROTECTION_RULE module is supported. Support for more WAF modules may be added in the future.
-
<adom-name>: The name of the ADOM where the profile is defined (e.g., root).
-
<profile-name>: The name of the WAF module profile.
|
No default.
|
|
set shared-waf-instance-mode-on-non-CR-dmode {enable | disable}
|
Enables or disables shared-instance mode globally for eligible WAF modules on non-CR (non-centralized rule) deployments. When enabled, FortiWeb instantiates only one copy of a given signature profile and tracks references from each policy that uses it.
Options:
|
disable
|
Example
This example shows the output of the pserver list command. The alive value indicates the status of the server health check:
| 0 |
Failed |
Red |
| 1 |
Passed |
Green |
| 2 |
Disabled |
Grey |
diagnose policy pserver list Policy1
policy(Policy1)
server-pool(FortiWeb_server_pool):
total = 1
server[0]
id: 1
ip: 10.20.1.22
port: 80
alive: 2
session: 0
status: 1
Related topics
