Most HA events are logged in the file /log/l_system and associated with the “HA” service. The following types of HA events are logged:

  • Switching of the firewall's active/passive status,
  • Failure to load a configuration on the passive firewall when the cluster is initialized,
  • Shutdown of the Stated daemon on a cluster member,
  • Startup of the Stated daemon on a cluster member,
  • When HA is paused (e.g., when the filter policy is being reloaded),
  • Failure to reload a configuration when HA restarts,
  • Conflict of licenses between members of the cluster,
  • Failure to initialize a synchronization,
  • No response from the other member of the cluster during restart (switches the restarted firewall to active),
  • The other member of the cluster was not detected,
  • The other member of the cluster was detected (causes a full bulk update),
  • When a bulk update is launched,
  • Unsuccessful synchronization,
  • Synchronization ended normally,
  • When a cluster member shuts down or restarts,
  • Network configuration reloaded,
  • Date/time synchronization,
  • Transmission error (packets lost),
  • Configuration file synchronization error.


These events can be viewed in Monitoring > Logs - Audit logs > System events in the firewall’s web administration interface (shown below with a filter on the term HA):