Technical Tip: How to check FortiManager database integrity prior to firmware upgrade
Description
This article describes how to check the integrity of FortiManager databases before a firmware upgrade.
Before upgrading, verify the supported FortiManager firmware upgrade path for the target release: FortiManager firmware upgrade paths.
Important: Take a valid FortiManager configuration backup before running these checks. Some integrity commands can propose or perform database corrections when an inconsistency is detected.
Before running the commands, ensure that only one administrator is logged in and that no objects are locked. If workspace mode is enabled, unlock all ADOMs before running the integrity checks.
If any command reports an error, failure, mismatch, corruption, or proposed database change, do not proceed with the firmware upgrade until the complete output has been reviewed.
Scope
FortiManager.
Solution
Check the integrity of the Policy Manager database:
diagnose pm2 check-integrity all
Note: This command detects database errors but does not correct them. If an error is reported, stop the upgrade preparation and collect the complete CLI output for review.
Example output without errors:
FMG # diagnose pm2 check-integrity all
--- pragma integrity_check adom db ---
--- total: 23 ok.
--- pragma integrity_check device db ---
--- total: 5 ok.
--- pragma integrity_check global db ---
--- total: 2 ok.
--- pragma integrity_check ips db ---
--- total: 5 ok.
--- pragma integrity_check task db ---
--- total: 1 ok.
--- pragma integrity_check ncmdb db ---
--- total: 26 ok.Check the integrity of the Device Manager database:
diagnose dvm check-integrity
Caution: Do not use 'diagnose dvm check-integrity' on FortiManager v7.4.8. Known issue 1228166 may cause unintended behavior when this command is run against an already corrupted Device Manager database. Refer to the FortiManager v7.4.8 release notes under Known Issues.
The exact number of checks displayed may vary by FortiManager version.
If the output reports that changes will be made and prompts for confirmation, do not accept the changes without first confirming that a valid backup exists and reviewing the proposed changes.
Example output without errors:
FMG # diagnose dvm check-integrity
[1/11] Checking object memberships ... correct
[2/11] Checking adom nodes ... correct
[3/11] Checking device nodes ... correct
[4/11] Checking device vdoms ... correct
[5/11] Checking duplicate device vdoms ... correct
[6/11] Checking device ADOM memberships ... correct
[7/11] Checking device HA Secondary ... correct
[8/11] Checking device clusters ... correct
[9/11] Checking groups ... correct
[10/11] Checking group membership ... correct
[11/11] Checking task database ... correctCheck the integrity of the ADOM configurations:
diagnose cdb check adom-integrity
To check a specific ADOM only, specify its name:
diagnose cdb check adom-integrity <adom-name>
Version notes:
This command does not work on FortiManager v5.4.3 or on versions earlier than v5.2.11.
FortiManager v7.6.6 has known issue 1241561 (Known issues) where 'diagnose cdb check adom-integrity' may fail. This issue is resolved in FortiManager v7.6.7.
Example output without errors:
FMG # diagnose cdb check adom-integrity
General updating - adom FAZ200D ... 100% No errors
General updating - adom FAZ200F ... 100% No errors
General updating - adom FortiCarrier ... 100% No errors
General updating - adom FortiFirewall ... 100% No errors
General updating - adom root ... 100% No errors
General updating - adom Global ... 100% No errors
Depending on the FortiManager version, successful output may display wording such as No errors or Ready to update. The important result is that no error is reported.
Check the integrity of the policy packages:
diagnose cdb check policy-packages
The command without an ADOM name checks the applicable policy packages. To limit the check to a specific ADOM, specify the ADOM name:
diagnose cdb check policy-packages <adom-name>
The exact checks displayed may vary by FortiManager version. If the output states that changes will be made and prompts for confirmation, do not accept the changes without a valid backup and review of the proposed changes.
Example output without errors:
FMG # diagnose cdb check policy-packages
Adom root
[1/7] Checking Scope ... correct
[2/7] Checking Dynamic mappings ... correct
[3/7] Checking Policy package settings ... correct
[4/7] Checking Cross-linked objs ... correct
[5/7] Checking Object parent mismatch ... correct
[6/7] Checking Undeleted objs ... correct
[7/7] Checking Controller package status ... correct
Adom Global
[1/4] Checking Policy package settings ... correct
[2/4] Checking Cross-linked objs ... correct
[3/4] Checking Object parent mismatch ... correct
[4/4] Checking Undeleted objs ... correctCheck the object configuration database, reference table, ADOM database, DVM database, and invalid policy package and template installation targets:
diagnose cdb upgrade check +all
Important: This is not a purely read-only validation command. Its checks include upgrade-related database repair and correction operations. Ensure that a valid FortiManager configuration backup exists before running it.
This command does not work on FortiManager 5.6.0 or earlier.
FortiManager v7.6.6 caution: Known issue 1244008 (Known issues) may cause unexpected CLI behavior when a FortiAnalyzer is added as a managed device and a 'diagnose cdb upgrade check' command is executed. This issue is resolved in FortiManager v7.6.7.
Example output without errors:
FMG # diagnose cdb upgrade check +all
Checking: Object config database integrity
No error found.
Checking: Reference table integrity
No error found.
Checking: Repair invalid object sequence
No error found.
Checking: Reassign duplicated uuid in ADOM database
No error found.
Checking: Resync and add any missing vdoms from device database to DVM database
No error found.
Checking: Invalid policy package and template install target
No error found.
Checking: Firewall address wrong FQDN type
No error found.
Checking: Delete invalid device level mapping for normalized interface
No error found.
Checking: Delete invalid orphan entries
No error found.
Checking: Drop table of user group guest
No error found.
Checking: Invalid assign status entries
No error found.
Checking: Copy section title from previous policy config
No error found.
Checking: Fix invalid created timestamp
No error found.
Expected results:
diagnose pm2 check-integrity all: All database categories should return ok.
diagnose dvm check-integrity: All checks should return correct.
diagnose cdb check adom-integrity: No ADOM should report an error. Successful wording can vary by version.
diagnose cdb check policy-packages: All checks should return correct.
diagnose cdb upgrade check +all: Each section should return No error found.
If a command reports an error, failure, mismatch, corruption, an incorrect result, or proposed database changes, stop the upgrade preparation and collect the complete CLI output. Do not attempt undocumented database repairs or proceed with the firmware upgrade until the result has been reviewed.
Related articles:
