Can't see no logs from device

Hey

 I’d like to help, but could you please clarify a few points to better understand the issue?

1. When you say “can’t see devices that don’t send logs,” do you mean:

   • They are missing from CMDB entirely?

   • Or they appear in CMDB but show no logs in Log View/Search?

2. Could you share a screenshot of:

   • The CMDB report you ran

   • Your Advanced Search configuration

This would help us visualize the issue more clearly and provide better suggestions.

@adem_netsys 

Hi,

I was going to ask the same question as @DHNX - Are these devices in the CMDB at all? If not, there is nothing you can do about it. 

If they managed to register to the CMDB one way or another, but currently their "Event Status" in CMDB is different than Normal (or empty - because if it's empty, this means they were registered via discovery, but no event pulling/receiving had taken place), like Warning, Critical etc. Then you can just do it like this:

• Go to Resources > Rules > Availability > FortiSIEM
• Search for "no logs from device". A System rule named "No logs from a device" should show. Click Edit on this rule, Go to "Step 2: Define Condition" then click the pencil icon to the subpattern to edit it. When the edit window opens, there is a button "Run as Query". Click on this one. 
• A new browser tab will open with the subpattern definition executing in the "Analytics" module. Most probably it won't show any matching events. This is due to the fact, that the events this query looks for are System Events. And if not specified, by default FortiSIEM doesn't search in them.
• To fix this, edit the filter in the Analytics tab query that the "Run as Query" button opened and add additional condition which should state: "System Event Category" = 3.
• Choose the time range you want.
• Execute.
• Enjoy! :)

And why do you think the results are not OK? 

• In the first screenshot you run it for just 7 days.
• In the CMDB report, it shows devices which are not sending logs from 2024....
• In the Advanced Search, your query is not right and equal to the one you have executed in the normal Analytics tab...

Just try to unify your conditions and requirements and all of the three approaches will work.

BR

Hi @adem_netsys,

We also had trouble finding the desired answer in the default reports.

The best solution we came up with, was to combine two reports:

1. Analytics Report: No filter (so any log), group by "Reporting IP" (which happens by using "Reporting IP" and e.g. "COUNT(Matched Events)" as display columns)
2. CMDB Report: with the filter "Device IP" NOT IN "Above Analytics Report : Reporting IP" and "Device Status" = 2 (which means "Approved").

If you run this for the last 24 hours, you get all the devices which are marked as "approved" but did not send any logs in that timeframe.

[EDIT: Obviously, at the time we were implementing that, we just followed the tip in that post here: https://community.fortinet.com/t5/FortiSIEM-Discussions/How-do-i-get-devices-not-sending-logs-in-last-24-hours-in-report/m-p/313625 ]

Best,

Christian

It is like the devices might not be properly reporting to the server, or there could be a filter issue in the CMDB report. Checking agent connectivity and log collection settings usually helps pinpoint the problem. I saw a similar troubleshooting guide on Technewsoutlets. com that walked through resolving missing device logs in detail.