Technical Tip: How to investigate the root cause of FortiClient agents losing telemetry with EMS

Description

This article describes the needed steps to investigate the root cause of FortiClient agents losing telemetry with EMS.

Scope

 FortiClient.

Solution

1. Check Connection Status:
   
   Management Console: Start by checking the FortiClient management console to see the connection status of the affected endpoints. Look for any patterns or commonalities among the disconnected clients.
   
   

2. Use Diagnostic Tools:
   
   FortiClient Diagnostic Tool: Utilize the FortiClient Diagnostic Tool to gather logs and diagnostic data. This tool can help identify issues such as DNS resolution failures or network configuration problems.
   
   Navigate to the Diagnostic_Result -> FCDiagData -> General -> Logs -> Trace directory and open the FortiESNAC_1.log file to look for errors related to server connectivity or DNS resolution.
   
   

3. Review DNS Configuration:
   
   DNS Resolution Issues: Ensure that DNS resolution is functioning correctly. FortiClient may fail to connect to EMS if DNS queries are blocked or misconfigured.
   
   Check for any application firewall settings that might be blocking DNS queries to the EMS cloud FQDN, such as forticlient-emsproxy.forticloud.com.
   
   

4. Firewall and Network Configuration:
   
   Application Firewall: Verify that the application firewall is not blocking necessary network services. If the firewall is configured to block certain categories, it might prevent FortiClient from reaching EMS.
   
   Network Logs: Review network logs for any anomalies or blocked traffic that could affect connectivity.
   
   

5. EMS and FortiClient Version Compatibility:
   
   Version Check: Ensure that both FortiClient and EMS are running compatible versions. Incompatibilities can sometimes lead to connectivity issues.
   
   FortiClient Windows, macOS, Linux Compatibility with FortiClient EMS
   
   

6. Check for Known Issues:
   
   Fortinet Documentation: Refer to Fortinet's documentation for any known issues or updates that might address the problem. This can include checking for any recent updates or patches that need to be applied.
   
   

The following steps should help identify the root cause of the telemetry connection issue between FortiClient and EMS.
If the issue persists after completing these steps, contact Fortinet Support Portal for further assistance.