Logs for firebox reboot or power down/up

Ahcomput

It appears as though a watchguard T80 running 12.9.2 that we manage has been rebooting at different times. Does anyone know how to confirm this in the logs or get any information from the logs about what is causing this? We are currently logging to watchguard cloud. I find in firebox system manager the uptime on the front panel, but no explanation or other detail about it. Thanks in advance for any help.

Bruce_Briggs

Possible causes:
1) firewall faults
You can check for fault reports:
Manage Fault Reports
https://www.watchguard.com/help/docs/help-center/en-US/Content/en-US/Fireware/fsm/fault-reports_manage_c.html

2) power outage - even just 1 second can cause a reboot
You won't see a reason on the firewall logs for a power outage/blip - just the standard boot up log messages and the uptime value being recent.

On the WG cloud Log Manager - be sure to select Event Logs - which should show your external interface coming up after a reboot, such as this:
[eth0 (External)] Activating external interface
That will give you an approx time that the firewall came up.

If you have Link Monitor set up, then that can give you a time that something happened.
[Link Monitor] No response received on External from Ping target 8.8.8.8

I had a power blip 3 days ago, and I see Link Monitor log entries, and the somewhat later the "Activating external interface".

Also note that debug log message types are not shown in the cloud log.

Standard boot up log messages are not shown either as the interface for sending log messages to the cloud is not up yet.

james.carson

Hi @Ahcomput

-First, go to software.watchguard.com and download Fireware 12.9.4 for your T80. Once downloaded, install 12.9.4. There's a number of bugfixes that have been released over the last two releases that may help.

-Second, you can look in the firewall's support file for the system.log file. This file logs when the firewall boots up, like:

Jul 16 00:59:26 2023 JamesFirewall-1 local2.info systemd[2849]: msg_id="5501-0000" System boot up at 2023-07-16 00:58:57-0500

You can find the system.log file here in the support file:
support.tgz\\support\current_log\system.log

You can get a support file by:
-In WatchGuard System Manager, open Firebox System manager, go to the status report tab, click support, then retrieve.
-In WebUI, go to System Status -> Diagnostics, and click to download a support log file.
You'll need a program that can open TGZ files (Like 7-zip) in order to open the support file, and a text editor to see the files (like notepad++.)

You can also see if there are any fault reports:
(Manage Fault Reports)
https://www.watchguard.com/help/docs/help-center/en-US/Content/en-US/Fireware/fsm/fault-reports_manage_c.html

Ahcomput

Thank you both for the info.
Bruce: I do suspect power events as the only logs Im seeing is when the external interface comes up, never an entry that
it goes down even though I have link monitor configured.

James: I will review the support file for any info I can get.