Troubleshooting Tip: Windows agent upgrade using image server best practice

Prerequisites:

1. The agent's Status must be Running Active.

• If the Agent is registered with a Supervisor, the status shows as Disconnect, but it is uploading events successfully. To fix this issue, see this article: Troubleshooting Tip: Windows Agent registered with Supervisor but not uploading events.
  
  

• If the Agent is registered with the Collector, see Troubleshooting Tip: Win/Linux Agent registration with Collector as Proxy and troubleshooting.
  
  

2. Verify files 'AutoUpdate.exe', 'FSMLogAgent.exe' before uploading to the Image Server, and make sure the files have a valid signature by 'right-clicking' -> Properties -> Select Fortinet Signature -> Details -> This digital signature is OK.
   
   

    

3. Upload the files to the Admin -> Settings -> System -> Image Server.

• Note: If the Windows host (Agents) reach the Collector or Supervisor through a Load Balancer or Public IPs, then, before uploading the .exe files to the Image Server, add the load balancer/public IP in Image Server -> Custom Update. Only after that, upload the files.
  

See the documentation link: Image Server Settings.

To confirm the files are uploaded successfully, run the following command in Supervisor: 

ls -la /opt/phoenix/WinAgentUpgrade/

4. Run the Download Image to the Windows host (Agent) in the Health tab.

If the download task failed:

Troubleshooting:

1. Confirm that the files have been uploaded to the Supervisor correctly. Run the following command in Supervisor:

psql -U phoenix phoenixdb -c "select param_str, progress, status, type from ph_task where type='ImageSetup'";

Progress should indicate 100:

2. On the Windows host, go to the folder C:\ProgramData\FortiSIEM and review the Autoupdate.log for more information about the error/failure.

If the AutoUpdate log shows the following error: 

[error] Invalid signature of file: C:\ProgramData\FortiSIEM\AutoUpdate.exe

Make sure the latest patch and update are installed in the Windows OS 
Make sure the following certificate is installed:
DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1

3. Change the Agent's log to Debug mode as the FortiSIEM Windows Agent Installation Guide indicates: Troubleshooting from Windows Agent.

    

• Re-run the Download Image task from the SIEM GUI and review the Agent's C:\ProgramData\FortiSIEM\Agent\Logs\Trace.log.

• The debug trace.log contains more information about the download URL and errors. 

4. If the Agent is registered with the Collector FQDN/IP. Ensure the agent-proxy.conf file contains all the proxy configuration lines from the latest release document.
   See the link below for the Windows Agent Configuration Guide v7.4.2: Installing Windows Agent Without Supervisor Communication.