Skip to main content
ppatel
Staff & Editor
ppatel
Staff & Editor
August 30, 2021

Technical Tip: FSSO is missing logon information and 'Error: Insufficient buffer' is present in Collector Agent logs (debug)

  • August 30, 2021
  • 0 replies
  • 1540 views
Description

This article describes an issue where the FSSO Collector Agent (CA) may miss user logon events when the monitoring method “Check Windows Security Event Logs” is used. 

 

When certain features or auditing policies are enabled on a Domain Controller (DC), the size of Windows Security Event Log records may increase significantly. If an event record exceeds the buffer size allocated by the FSSO Collector Agent during event processing, the CA cannot parse the event properly. In such cases, the Windows API returns the error:

 

ERROR_INSUFFICIENT_BUFFER

 

When this condition occurs, the Collector Agent is unable to parse the event record and therefore skips the event entirely.

As a result, the Collector Agent may miss user logon events such as:

  • Event ID 4624 (Successful logon).

  • Event ID 4768 / 4769 (Kerberos authentication events).

 

Since the Collector Agent cannot process these events, the corresponding user login information is not forwarded to the FortiGate, which may lead to:

  • Users appear unauthenticated on the firewall.
  • User-based firewall policies are not being applied correctly.
  • Incorrect or missing entries in the FSSO user list.

 

This behavior is typically observed in environments where:

  • Advanced Windows auditing policies are enabled.
  • Security event logs contain extended attributes.
  • Additional authentication metadata increases event record size.
Scope FortiGate.
Solution

To prevent this issue, it is recommended to switch the FSSO monitoring method to WMI (Windows Management Instrumentation). See the image below: 

 

Capture.PNG

 

The WMI method retrieves logon information using Windows management interfaces rather than parsing Security Event Log records directly. Because of this, it is not affected by event log record size limitations, making it more reliable in environments where security events contain large payloads. To change the monitoring method in the FSSO Collector Agent:

  1. Open the FSSO Collector Agent Configuration.

  2. Navigate to Advanced Settings.

  3. Under DC Monitoring Mode, select WMI Polling.

  4. Ensure appropriate WMI permissions and connectivity are configured between the Collector Agent and the Domain Controllers.

 

After switching to WMI monitoring, verify that user logon events are being properly detected and forwarded to the FortiGate. 

 

On the FortiGate CLI, verify whether the user logon information is received:

 

diagnose debug authd fsso list
 
Note: This behavior has been implemented since v5.0272 (in previous releases, the FSSO processing got stuck).
Terms & ConditionsAccessibility statement