Maintenance mode hanging

Forum|Forum|2 years ago
January 4, 2024
6 replies
5130 views

Good afternoon,

We have several devices that go into maintenance mode each Friday until Monday morning because they are on-demand servers. When the period ends, the devices seem to hang in maintenance mode. This only occurs for one organization. Fortinet support has not been of much help. Has anyone seen this issue before and have any solutions to offer. I am NOT our primary admin and can not access the deeper functions but can ask our admin to try certain suggestions

FortiSIEM #6.7.8

FSM_FTNT

Staff

are you sure this is for FortiSIEM and not a different Fortinet product?

lcwoods529Author

New Member

Yes, I am sure.

Secusaurus

Contributor III

Hi lcwoods,

I suppose, the TAC already asked a couple of these questions, just to dig deeper into that:

What is your definition of "hang in maintenance mode"? Are they not triggering incidents? Is there an indication in CMDB or elsewhere showing "maintenance"?
What is your exact definition of the maintenance window? (can you share a screenshot?)
You state that it is only affecting one organization. Did/can you setup the exactly same maintenance window on another org just to verify? In which view did you create the window (global or inside the org)?
Obviously, the TAC will have a look at the AO logs. I don't think, it's good to share them here publicly, but you might want to have a look at these ones (and their errors) by yourself? (I usually start by investigating the AOLogs\appsvr\phoenix.log.gz)

I am pretty sure, TAC should be the one to solve that if it's kind of a bug (perhaps share the ticket id with @FSM_FTNT), but depending on your answers we might uncover a config flaw.

Best,

Christian

NSE8 | Fortinet Advanced MSSP Partner

lcwoods529Author

New Member

Once a device goes into maintenance mode and after the set period has elapsed, it will not receive any metrics. If we attempt a rediscover we receive the error message "device is currently under maintenance" even though the time has elapsed. Fortinet has already reviewed the AO logs. In fact, several admins have. They could not find anything useful. Their solution is to upgrade to the latest version. For various reasons, that is not a viable solution currently.