Troubleshooting Tip: Install policy package throws copy error related to ('system settings', '', id=0, COMMIT FAIL - invalid value)

Description

This article describes how to troubleshoot the copy error shown below when installing a policy package. 

Scope

FortiManager, FortiGate.

Solution

Perform debugging to understand which part of the configuration causes the error:

diagnose debug application securityconsole 255

diagnose debug enable

Example outputs:

Response [gui webforward:23704:7d64e362-c95a-490c-9719-90311dbd5686]:
{ "id": "7d64e362-c95a-490c-9719-90311dbd5686", "result": [{ "data": { "message": "Copy device global objects\n\nVdom copy failed\n\nCopy objects for vdom root\n\"system settings\", \"\", id=0, COMMIT FAIL - invalid value\n\n"}, "st
atus": { "code": 0, "message": "OK"}, "url": "\/securityconsole\/copy\/result"}]}
Request [gui webforward:23709:1b911b7a-b8e4-4348-b2df-355176f50052]:
{ "client": "gui webforward:23709", "id": "1b911b7a-b8e4-4348-b2df-355176f50052", "keep_session_idle": 1, "method": "exec", "params": [{ "data": { "adom": 3}, "target start": 1, "url": "\/securityconsole\/package\/cancel\/install"}],
"session": 50562}

This information does not explain what the specific issue is. See details under View progress report with the error 'post_vdom copy error::(errcode)15 -used.details:delete failed . solution : record is in-use'.

To resolve this, check the policy package that needs to be installed under Policy & Objects -> Policy Packages -> Select Policy Package -> Right-click  -> Edit -> Policy Offload Level (must be the same as the device database).

For example, the FortiGate CLI configuration may be as follows:

config system settings

    set policy-offload-level disable

end

Note: This configuration is only available on FortiGate hardware in the mid-range (3-digit versions) and above.

Check the device database level under Device Manager -> Device & Groups -> Select FortiGate -> CLI Configurations -> Search (system -> settings) -> policy-offload-level.