Troubleshooting Tip: Event Status Shows ‘Critical’ in Agent Health After Firmware Upgrade, Despite Normal Event Transmission

This issue typically arises after a FortiSIEM upgrade, during which the Agents temporarily lose connection with FortiSIEM for a few minutes.

Pre-requisites:

• The Agent displays a Critical status under Admin -> Health- > Agent Health -> Event Status.
• The Agent displays a Normal status under Admin -> Health -> Agent Health -> Monitor Status.
• Selecting the Event Receive Status reveals two or more metrics.
• The oldest 'Last Successful' status is marked Critical (highlighted red), while the latest is Normal (highlighted green).
• An example of screenshot is seen below:

Steps to Resolve:

For FortiSIEM versions below 7.2.0:

1. Navigate to CMDB and select the affected device(s).
2. Select the Monitor tab.
3. In the Event Receive Status window, locate and click the small Delete button to remove the critical metric.

For FortiSIEM versions 7.2.0 and above:

1. Navigate to CMDB and select the affected device(s).
2. Select Actions -> Details -> Monitor.
3. Select the metric marked as Critical and delete it.