On a FortiGate, file submissions to FortiSandbox are handled by the quarantine daemon (quarantined). To troubleshoot why samples are not being sent, Fortinet's official troubleshooting guidance directs administrators to enable real-time debug output for this daemon using the command diagnose debug application quarantine -1, followed by diagnose debug enable. This produces live debug logs showing the daemon's attempts to connect to and submit files to FortiSandbox, including connectivity errors (such as failed TCP/SSL connections on the FortiSandbox submission port) that explain why samples are not being delivered. The other listed commands are unrelated to this troubleshooting task: the ipsmonitor test command pertains to the IPS engine, and the antivirus quarantine purge command simply deletes locally quarantined files rather than providing diagnostic output about FortiSandbox communication.
Community Discussion