mirror of
https://github.com/yuriskinfo/cheat-sheets.git
synced 2025-12-21 21:33:25 +01:00
134 lines
3.6 KiB
Plaintext
Executable File
134 lines
3.6 KiB
Plaintext
Executable File
= Fortianalyzer diagnose and debug cheat sheet
|
|
Author: Yuri Slobodyanyuk, https://www.linkedin.com/in/yurislobodyanyuk/
|
|
|
|
:homepage: https://yurisk.info
|
|
|
|
:toc: auto
|
|
|
|
|
|
<<General Health>> +
|
|
<<Communication debug>> +
|
|
<<Logs from devices>> +
|
|
<<Licensing>> +
|
|
|
|
|
|
== General Health
|
|
[cols=2, options="header"]
|
|
|===
|
|
|Command
|
|
|Description
|
|
|
|
|
|
|*get sys status*
|
|
|Get general information: firmware version, serial number, ADOMs enabled or not, time and time zone, general license status (Valid or not).
|
|
|
|
|*get sys performance*
|
|
|Detailed performance statistics: CPU load, memory usage, hard disk/flash disk used space and input/output (`iostat`) statistics.
|
|
|
|
|*exe top*
|
|
|Display real time list of running processes with their CPU load.
|
|
|
|
|*diag log device*
|
|
|Shows how much space is used by each device logging to the Fortianalyzer, including quotas.
|
|
|
|
|*exe iotop -b -n 1*
|
|
|Display and update every 1 second READ/WRITE statistics for all the processes.
|
|
|
|
|
|
|*diagnose system print cpuinfo*
|
|
|Display hardware CPU information - vendor, number of CPUs etc.
|
|
|
|
|*diagnose hardware info*
|
|
|Even more hardware-related info.
|
|
|
|
|*diagnose system print df*
|
|
|Show disk partitions and space used. Analog of the Linux `df`.
|
|
|
|
|*exe lvm info*
|
|
|Shows disks status and size
|
|
|
|
|*diagnose system print loadavg*
|
|
|Show average system load, analog to the Linux `uptime` command.
|
|
|
|
|*diagnose system print netstat*
|
|
|Show established connections to the Fortianalyzer, as well as listening ports. Every logging device can (and usually does) have multiple connections established.
|
|
|
|
|*diagnose system print route*
|
|
|Show routing table of the Fortianalyzer.
|
|
|
|
|
|
|===
|
|
|
|
== Communication debug
|
|
[cols=2, options="header"]
|
|
|===
|
|
|Command
|
|
|Description
|
|
|
|
|*diagnose test application oftpd 3*
|
|
|List all devices sending logs to the Fortianalyzer with their IP addresses, serial numbers, _uptime_ meaning connection establishment uptime, not remote device uptime, and packets received (should be growing).
|
|
|
|
|
|
|
|
|*diagnose debug application oftpd 8 <__Device name__>*
|
|
|
|
*diagnose debug enable*
|
|
|Real time debug of communicating with the __Device name__ device.
|
|
|
|
|*diagnose sniffer packet any "host __IP of remote device__"*
|
|
|Sniff packets from/to remote device, to make sure they are sending each other packets. The communication is encrypted.
|
|
|
|
|*diagnose sniffer packet any "port 514"*
|
|
|Sniff all packets to/from port 514 used by Fortianalyzer to receive logs from remote devices.
|
|
|
|
|
|
|===
|
|
|
|
|
|
== Logs from devices
|
|
[cols=2, options="header"]
|
|
|===
|
|
|Command
|
|
|Description
|
|
|
|
|*diagnose test application oftpd 50*
|
|
|Show log types received and stored for each device.
|
|
|
|
|
|
|*diag log device*
|
|
|Shows how much space is used by each device logging to the Fortianalyzer, including quotas.
|
|
|
|
|*diagnose fortilogd lograte*
|
|
|Show in one line last 5/30/60 seconds rate of receiving logs.
|
|
|
|
|*diagnose fortilogd lograte-adom all*
|
|
|Show as table log receiving rates for all ADOMs aggregated per device type (i.e. rate for all Fortigates will be as one data per ADOM).
|
|
|
|
|*diagnose fortilogd lograte-device*
|
|
|Show average logs receive rate per device for the last hour, day, and week.
|
|
|
|
|*diagnose fortilogd lograte-total*
|
|
|Show summary log receive rate for all devices on this Fortianalyzer.
|
|
|
|
|
|
|
|
|===
|
|
|
|
== Licensing
|
|
[cols=2, options="header"]
|
|
|===
|
|
|Command
|
|
|Description
|
|
|
|
|*diagnose dvm device list*
|
|
|Look for the line _There are currently N devices/vdoms count for license_.
|
|
|
|
|*diagnose debug vminfo*
|
|
|Show report on Virtual Machine license: whether valid or not, type, licensed storage volume, licensed log receive rate, licensed maximum device count.
|
|
|
|
|
|
|===
|
|
|
|
|
|
|