Troubleshooting Tip: FortiEDR Jumpbox is disconnected

The following disconnected state can be seen in an on-prem Jumpbox after network issues in the local network:

Steps to resolve:

1. Log in to the Jumpbox and verify FortiDR service is running:

fortiedr status

2. Verify connection and DNS resolution with an EDR Manager and Aggregator (port 8081) via ping and telnet.
   
   
3. If the connection is OK with EDR Manager, proceed to restart FortiEDR services in the Jumpbox:

fortiedr stop
fortiedr start

fortiedr status

fortiedr version

If the Jumpbox/Core continues to be disconnected after running these steps, collect the Core logs by following these steps:

1. Stop the Core service:

fortiedr stop

2. Zip the Core directory using tar:

tar -czvf core_logs.gz /opt/FortiEDR/core

3. Export the 'core_logz.gz' folder and upload it to the support ticket.
   
   
4. Start the Core service:

fortiedr start

Note:

To track the latest releases (including Core versions), refer to the article below:

Technical Tip: FortiEDR - Latest Release Version Chart & EOL Details