Skip to main content
KarlH
KarlH
Explorer II
November 6, 2024
Solved

Deleting an Organization in Setup view - Data base error occures in FortiSIEM7.1.3

  • November 6, 2024
  • 5 replies
  • 2797 views

 

Hello

 

over in Admin -Setup- Organization

the Error appeared when I tried to delete an organization, one of our clients who has terminated service.  Any ideas on what this is due to? or how I can fix? is this the Database being confused somehow?

 

 

Datbaseerror.png

 

Thanks in advance.

 

 

 

Best answer by ForrestF1re

Sorry for the bump on this, but checking in to see if any further update other than "Raise to TAC" was found? I'm currently facing this with two organizations in our FortiSIEM. Going to raise a TAC case myself. 

5 replies

Richie_C
Staff
Richie_C
Staff
November 6, 2024

Hi @KarlH 

 

It looks like you have some references in Global to the Org you are trying to delete. The screenshot specifically mentions rules. But it could be worth checking other references such as notification policies or admin accounts.

 

Regards

KarlH
KarlHAuthor
Explorer II
November 6, 2024

OK @Richie_C thank you  I will seek those out sure will be nice to upgrade to a newer version of the Supervisor and SIEM where I'm sure the error message are far more human friendly and informative.

 

Also FYI its considered an vulnerability to expose back-end system errors to the user.. Fortinet really should not allow system errors to percolate to the human user.  Most likely a Try Catch mistake. Simulate scenarios where exceptions are thrown, and verify that user-friendly, non-sensitive error messages are displayed.

KarlH
KarlHAuthor
Explorer II
November 7, 2024

I switched the SIEM from global to the organization in question, this is proving more complicated than I expected. I'm not sure what I'm looking for.  What are the tables specifically used for? in my initial query?  I'm suspicious this is not meant for the end user and I am not going to debug FortiSIEM.

KarlH
KarlHAuthor
Explorer II
November 12, 2024

 

Receiving the error below after going to Admin, Setup and than Organisations and trying to delete an organization.  

----------------------------------------------------------------------------------

 Please make sure the following items in this org/collector are not needed and try removing them first.

Root cause: ERROR: update or delete on table "ph_drq_rule" violates foreign key.

constraint "fk391a2638ad87dc6d: on table "ph_dwl_rule_mapping"

Detail: key (id)=(10660979) is still referenced from table "ph_dwl_rule_mapping".

------------------------------------------------------------------------------------

 

So far I have heard to check notifications, notification policies, admin accounts and of course rules.

Where to go to delete them ? and how? LOL

 

 

KarlH
KarlHAuthor
Explorer II
November 20, 2024

HI,

 

I cannot seem to get Fortinet to even respond to my ticket, this is Fortinet db issue and it needs assistance to clean it. I am not going to go into phoenixdb and start messing with this. Fortinet can you please respond to  my ticket 10093987.  Does this really take 9 days?   Thanks Karl

    ForrestF1re
    ForrestF1reAnswer
    Explorer
    December 10, 2024

    Sorry for the bump on this, but checking in to see if any further update other than "Raise to TAC" was found? I'm currently facing this with two organizations in our FortiSIEM. Going to raise a TAC case myself. 

    KarlH
    KarlHAuthor
    Explorer II
    December 10, 2024

    Hey @ForrestF1re , no worries,   The hierarchy goes like this, and anyone please correct me,.

     

    Org -> delete  rules (we have to switch to the org itself in the rules view the reports view and the notification view )

    not the global setting in the upper right corner.

     

           delete   reports    ( again I am unclear, I accidentally deleted all the canned reports that came with 7.1.3, how do we know what to delete. ?

    And if all else fails you create a TAC ticket and they go mess with the PSQL. 

      ForrestF1re
      ForrestF1re
      Explorer
      December 18, 2024

      Thanks Karl! Just had that as well, that error was... Interesting. 

       

      But it worked, thanks for the help and understanding with it. 

      Terms & ConditionsAccessibility statement