Chapter 9 High Availability for FortiOS 5.0 : HA and failover protection : Synchronizing the configuration : How to diagnose HA out of sync messages
  
How to diagnose HA out of sync messages
This section describes how to use the commands diagnose sys ha showcsum and diagnose debug to diagnose the cause of HA out of sync messages.
If HA synchronization is not successful, use the following procedures on each cluster unit to find the cause.
To determine why HA synchronization does not occur
1. Connect to each cluster unit CLI by connected to the console port.
2. Enter the following commands to enable debugging and display HA out of sync messages.
diagnose debug enable
diagnose debug console timestamp enable
diagnose debug application hatalk -1
diagnose debug application hasync -1
Collect the console output and compare the out of sync messages with the information in Table 59.
3. Enter the following commands to turn off debugging.
diagnose debug disable
diagnose debug reset
To determine what part of the configuration is causing the problem
If the previous procedure displays messages that include sync object 0x30 (for example, HA_SYNC_SETTING_CONFIGURATION = 0x03) there is a synchronization problem with the configuration. Use the following steps to determine the part of the configuration that is causing the problem.
If your cluster consists of two cluster units, use this procedure to capture the configuration checksums for each unit. If your cluster consists of more that two cluster units, repeat this procedure for all cluster units that returned messages that include 0x30 sync object messages.
1. Connect to each cluster unit CLI by connected to the console port.
2. Enter the following command to turn on terminal capture
diagnose debug enable
3. Enter the following command to stop HA synchronization.
execute ha sync stop
4. Enter the following command to display configuration checksums.
diagnose sys ha showcsum 1
5. Copy the output to a text file.
6. Repeat for all affected units.
7. Compare the text file from the primary unit with the text file from each cluster unit to find the checksums that do not match.
You can use a diff function to compare text files.
8. Repeat steps 4 to 7 for each checksum level:
diagnose sys ha showcsum 2
diagnose sys ha showcsum 3
diagnose sys ha showcsum 4
diagnose sys ha showcsum 5
diagnose sys ha showcsum 6
diagnose sys ha showcsum 7
diagnose sys ha showcsum 8
9. When the non-matching checksum is found, attempt to drill down further. This is possible for objects that have sub-components.
For example you can enter the following commands:
diagnose sys ha showcsum system.global
diagnose sys ha showcsum system.interface
Generally it is the first non-matching checksum in one of the levels that is the cause of the synchronization problem.
10. Attempt to can remove/change the part of the configuration that is causing the problem. You can do this by making configuration changes from the primary unit or subordinate unit CLI.
11. Enter the following commands to start HA configuration and stop debugging:
execute ha sync start
diagnose debug disable
diagnose debug reset