Hi Folks,
Quick question currently running FortiSIEM 7.2.5 and planning to perform content updates via the GUI.
Before I proceed, just wanted to double-check the best practices:
Is taking a normal VM snapshot sufficient as a fallback?
Or are there any specific prerequisites/recommended steps I should follow before doing content updates?
Thanks in advance
Hi
Content Updates should only change rules, parsers, reports and some other lists in the CMDB, nothing on the system itself.
Therefore, it should be safe to only keep the latest CMDB-backup to be re-installed if something goes wrong.
After the Content Update, some of the processes restart. Then the update is pushed to Workers and Collectors, and (depending on the update) some of their processes also restart.
I've seen some rare cases where the process restarts of the Workers don't work well, so you have to manually restart their processes (or just the whole Workers), but that's very uncommon. I've not seen more issues than this yet.
Anyways, answering your question: if you do a snapshot, this is more than sufficient.
Best,
Christian
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.
