Skip to main content
Ezzat
Ezzat
Visitor III
June 12, 2023
Question

Rule Test Fails

  • June 12, 2023
  • 1 reply
  • 2706 views

Hello,

I am using FortiSIEM version 6.5, and created rule and test it but always end up with internal error and fail. However, I find out that even for already activated rules from the system, when I clone them, deactivate them, and then test them, they fails again with the same error " internal error, where the rule master drop rule state summary from rule worker". 

 

What could be the issue here, given the fact that everything is working properly when I run it as a query ?

 

    1 reply

    FSM_FTNT
    Staff
    FSM_FTNT
    Staff
    June 12, 2023

    Hi, we have recently found with 6.7.x an issue with the Enterprise install of FortiSIEM that the Rule test isn't working and may be affecting you. It doesn't involve a rule actually triggering, just test.

     

    If you raise a TAC case, they can confirm if you are hitting this issue.

      Ezzat
      EzzatAuthor
      Visitor III
      June 12, 2023

      Thank you for your answer, I already created a ticket with the support of Fortinet but till now they didn't confirm it neither answered me yet. I also sent them some logs and text files for them to check and analyze. 

      FSM_FTNT
      Staff
      FSM_FTNT
      Staff
      June 12, 2023

      Hi Ezzat, please private message the TAC case and will check with the team.

       

      Thanks

      Terms & ConditionsAccessibility statement