Troubleshooting Tip: FortiEDR collector degradation

Description

This article describes a situation where FortiEDR Collectors become degraded and are unable to receive configuration updates from the FortiEDR Manager.

Scope

FortiEDR.

Solution

Follow these steps:

1. Move affected collectors to a different group; this will force the configuration update. if not work, perform a backend configuration push to force the FortiManager to resend the complete configuration to the Collectors. This can be done by contacting Fortinet Support.

2. As a workaround, move the affected Collectors to a different group and then move them back to trigger a configuration refresh.

It is also important to note that FortiEDR continuously monitors the backend infrastructure. However, Collector degraded states are not currently part of the monitoring and alerting process.

3. If not, restart the FortiEDR Collector Service to push the configuration update.

Windows OS:

"C:\Program Files\Fortinet\FortiEDR\FortiEDRCollectorService.exe" --stop -rp:<REGISTRATION_PASSWORD> 

"C:\Program Files\Fortinet\FortiEDR\FortiEDRCollectorService.exe" --start 

"C:\Program Files\Fortinet\FortiEDR\FortiEDRCollectorService.exe" --status

Linux OS:

sudo /opt/FortiEDRCollector/control.sh --stop <registration password>

sudo /opt/FortiEDRCollector/control.sh --start

sudo /opt/FortiEDRCollector/control.sh --status

Note the difference between a degraded collector and a disconnected collector:

• A degraded collector is still connected and communicating with the FortiEDR environment, but it is unable to operate at full capacity. This can occur due to issues such as resource limitations, compatibility problems, or other conditions affecting its functionality.

• A disconnected collector indicates that the endpoint is offline, powered off, or has lost communication with the aggregator. This does not necessarily mean there is an issue with the Collector itself.