Skip to main content
mshubham
Staff
mshubham
Staff
April 25, 2025

Technical Tip: FortiSIEM upgrade best practices

  • April 25, 2025
  • 0 replies
  • 3639 views

Description

This article describes the essential best practices to follow before, during, and after the upgrade process of FortiSIEM.

Scope

FortiSIEM

Solution

Pre-upgrade checklist:

 

  1. Verify network connectivity: Ensure the FortiSIEM node has HTTPS (port 443) access to the following domains:

os-pkgs-cdn.fortisiem.fortinet.com.


os-pkgs-r8.fortisiem.fortinet.com.

 

Use the commands below to verify:

curl -vk os-pkgs-cdn.fortisiem.fortinet.com
curl -vk os-pkgs-r8.fortisiem.fortinet.com

 

This access is crucial for downloading necessary packages and updates during the upgrade process.​

 

  1. Check disk space: Ensure that the root partition (/) has ample free space to accommodate the upgrade files and processes. Insufficient disk space can lead to upgrade failures or system instability.

 

It is possible to use 'df -h /' to monitor available space. Insufficient space during upgrades is a common failure point.

Check for fsmopt.tar.gz in the Root.

To check if fsmopt.tar.gz is consuming space:

cd /
ls -al | grep fsmopt 


To free up space:

 

mv /fsmopt.tar.gz /data/cache/
ln -s /data/cache/fsmopt.tar.gz /fsmopt.tar.gz


A symbolic link is optional.

  1. Assess system health: Navigate to Admin -> Health -> Cloud Health within the FortiSIEM interface to confirm that all system components are in a 'Normal' state. Address any anomalies or issues before proceeding with the upgrade.​

 

  1. Validate downloaded files: After downloading the upgrade archive from the Fortinet Support Portal, verify its integrity by checking the provided checksum. This step ensures that the file has not been corrupted or tampered with during the download process.​

 

  1. Consider proxy configurations: If the environment uses a proxy server, be aware that certain upgrade operations may be affected. Refer to the Upgrade via Proxy section in the official documentation for detailed guidance on handling proxy-related scenarios.​

 

  1. Review upgrade paths in Upgrading to FortiSIEM 7.5.x: Make sure to follow a supported upgrade path. For instance, if the current version is v7.2.5, it is necessary to upgrade to v7.3.1 or later first, as direct upgrades to v7.3.0 are not supported. ​Upgrade from v7.2.7 or v7.3.5 to v7.4.1 is not supported; upgrade to v7.4.2 instead.

 

  1. Backup configuration: Perform a full backup of the FortiSIEM configuration and data before initiating the upgrade. This backup serves as a restore point in case any issues arise during the upgrade process:

 

  1. Make sure no disk is mounted on /data before upgrading the ClickHouse-based FortiSIEM deployment.


Command to verify:

df -h


To unmount, run:

umount /data


Remove the entry for /data from the /etc/fstab file to make the change persistent across reboots.

 

  1. Ensure ClickHouse Keeper is not in 'read-only' mode (for ClickHouse users only):

 

clickhouse-client --query "SELECT hostname() AS host,database,table,replica_name,replica_path FROM clusterAllReplicas('fsiem_cluster', system.replicas) WHERE is_readonly"

 

Note: The output of the ClickHouse query will be empty if all the nodes are healthy.

 

  1. Make sure /etc/httpd/accounts/passwds file does not contain any lines starting with '#'. Remove them if they exist after taking a backup of the file.


cp -a /etc/httpd/accounts/passwds /etc/httpd/accounts/passwds_bak
sed -i '/^#/d' /etc/httpd/accounts/passwds


Notes: 

  1. If issues are faced with the collector downloading the upgrade image, follow the steps below:


psql phoenixdb phoenix -c "select value from ph_sys_conf where property='Image_Download_Url';"

 

  1. On the affected Collector, try a manual download:


cd /tmp
wget --no-check-certificate <URL from above psql command output>

 

  1. After the download is complete, move the file to '/opt/upgrade' after making sure the directory is empty. Remove any existing files and set the correct permissions: 


chown -R root:admin /opt/upgrade/
chmod 664 /opt/upgrade/FSM_Upgrade_All_7.2.1_build0241.zip
md5sum /opt/upgrade/FSM_Upgrade_All_7.2.1_build0241.zip

 

Upgrade execution:

 

Monitor upgrade logs: During the upgrade, monitor the Ansible log file located at:​

/usr/local/upgrade/logs/ansible.log


Review the end of this file for any errors or issues that may have occurred during the upgrade process.​

 

Post-upgrade recommendations:

 

  1. Reassess System Health: After the upgrade, revisit Admin -> Health -> Cloud Health to ensure all components are functioning correctly and are in a 'Normal' state.​

 

  1. Review System Logs: Examine system logs for any warnings or errors that may have arisen post-upgrade. Address any issues promptly to maintain system integrity.​

 

Note: The estimated downtime for upgrading a Supervisor will depend on the resources of the FortiSIEM node, but will range from approximately 1 to 1.5 hours.

 

Related documents:

    Terms & ConditionsAccessibility statement