Skip to main content
ATC
ATC
New Member
August 26, 2017
Question

FAZ not collecting logs after moving FGT from one ADOM to another ADOM

  • August 26, 2017
  • 16 replies
  • 25394 views

We use FAZ in analyzer mode with ADOMs. We recently moved a FGT from one ADOM to another, and then log collection just stopped for that device. I've tried removing the FGT device in FAZ and re-registering it, and it still fails to collect logs. I have also re-built the SQL db for that ADOM and re-indexed, but still no luck.

On the FGT, if I click TEST CONNECTIVITY button, everything looks fine--it shows the name of the FAZ, status is REGISTERED, and connection status and all priviliges get a green check mark. It also shows the number of logs that it is sending to the FAZ. But I don't know where they are going once they hit the FAZ.

Any suggestions would be appreciated!

    16 replies

    emnoc
    emnoc
    New Member
    August 27, 2017

    Does the fortigate show up in the device list? Are you  100% sure you edit the new adom and select that device? Have you  check the FAZ event logs for any clues?

     

     

    scao_FTNT
    Staff
    scao_FTNT
    Staff
    August 27, 2017

    can you help provide "diag dvm device list", "diag dvm adom list" and "diag log device"?

     

    Thanks

     

    Simon

    ATC
    ATCAuthor
    New Member
    August 27, 2017

    Result of "diag dvm device list"

     

    TYPE            OID    SN               HA      IP              NAME                                 ADOM                                 IPS                FIRMWARE        faz enabled     260    FG100Exxxxx01629 -       172.xx.xx.250   Axxxxxxxxxxxxxx                      Axxxxxxxxx                           N/A                5.0 MR4 (5873)         |- STATUS: db: unknown; conf: unknown; cond: unknown; dm: none; conn: unknown         |- vdom:[3]root flags:0 adom:Axxxxxxxxx pkg:[never-installed]

    ATC
    ATCAuthor
    New Member
    August 27, 2017

    Result of "diag log device" (removed non-essential info)

    ==============================================

    FAZVM64-HV # diag log device Device Name          Device ID            Used Space(logs / quarantine / content / IPS) Allocated Space  Used% Axxxxxxxxxxxxxx     FG100Exxxxxx01629        0.0KB(   0.0KB/   0.0KB/   0.0KB/   0.0KB) unlimited        n/a   Total: 17 log devices, used=52.0GB quota=unlimited     AdomName         AdomOID  Type                                 Logs                                                     Database                                 [Retention   Quota   UsedSpace(logs / quarantine / content / IPS) Used%]  [Retention   Quota      Used   Used%] Axxxxxxxxx       148      FGT     365days    14.6GB   12.2GB(  12.2GB/   0.0KB/   0.0KB/   0.0KB) 83.2%      60days    34.2GB   16.1GB   47.1% Total usage: 23 ADOMs, logs=52.0GB database=112.6GB(ADOMs usage:111.9GB + Internal Usage:707.8MB)   Total Quota Summary:     Total Quota      Allocated        Available        Allocate%            884.2GB          543.0GB          341.2GB          61.4%   System Storage Summary:     Total            Used             Available        Use%                 984.2GB          171.4GB          812.8GB          17.4%   Reserved space: 100.0GB (10.2% of total space).

    Terms & ConditionsAccessibility statement
    Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
    Fortinet Flag the Hack. Wednesday, August 26, 9:00 AM - 5:00 PM ET, COSM, Atlanta, GA.
    Virtual event | September 2026. SASE summit. The age of autonomous trust. Register here!