Device restarted (uptime low) for Fortinet

Vendor

Fortinet

Description

Indeni will alert when a device has restarted.

Remediation Steps

Determine why the device was restarted.
1. Watch the system reboot time.
2. Review the log messages and focus on error messages that were generated at least 5 minutes prior to system reboot, especially before unexpected system reboot.
3. Verify the status of the scheduled restart command to making sure it's an irregular restart
- config sys global
- get | grep restart
- end
4. Login via ssh to the Fortinet firewall and review the crash log in a readable format by using the FortiOS command "diag debug crashlog read".
5. Contact Fortinet Technical support at https://support.fortinet.com/ for further assistance.

How does this work?

Indeni uses the built-in Fortinet "get system performance status" command to retrieve the current device up-time.

Why is this important?

Capture the uptime of the device. If the uptime is lower than the previous sample, the device must have reloaded.

Without Indeni how would you find this?

An administrator could login and manually run the command via CLI, check the system resources widget via the GUI, enable SNMP, or use Fortinet FortiAnalyzer.

View Source Code
single