NSE4 · Question #123
Which of the following statements are correct regarding logging to memory on a FortiGate unit? (Select all that apply.)
The correct answer is B. When the system has reached its capacity for log messages, the FortiGate unit overwrites the C. If the FortiGate unit is reset or loses power, log entries captured to memory will be lost.. Logging to memory on a FortiGate uses a circular buffer that overwrites old logs when full, and all log data is lost if the unit is reset or loses power.
Question
Which of the following statements are correct regarding logging to memory on a FortiGate unit? (Select all that apply.)
Options
- AWhen the system has reached its capacity for log messages, the FortiGate unit will stop logging
- BWhen the system has reached its capacity for log messages, the FortiGate unit overwrites the
- CIf the FortiGate unit is reset or loses power, log entries captured to memory will be lost.
- DNone of the above.
How the community answered
(57 responses)- A4% (2)
- B86% (49)
- D11% (6)
Why each option
Logging to memory on a FortiGate uses a circular buffer that overwrites old logs when full, and all log data is lost if the unit is reset or loses power.
The FortiGate unit does not stop logging when memory capacity is reached; instead, it overwrites the oldest log messages, maintaining a continuous log history within the allocated memory.
When the memory allocated for logging on a FortiGate reaches its capacity, the system employs a circular buffer mechanism, meaning the oldest log entries are overwritten by new ones to ensure continuous logging without exhausting memory.
Log entries stored in the FortiGate's volatile memory (RAM) are temporary; consequently, if the unit is reset, rebooted, or experiences a power loss, all log data held in memory will be permanently erased.
Since statements B and C are correct, the option 'None of the above' is incorrect.
Concept tested: FortiGate memory logging behavior
Source: https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/339486/configuring-logging
Topics
Community Discussion
No community discussion yet for this question.