Skip to main content
FortiNet_Newb
FortiNet_Newb
New Member
November 20, 2024
Solved

FortiClient events no longer populate in EMS

  • November 20, 2024
  • 2 replies
  • 2335 views

Since upgrading our EMS server to 7.2.5 and our clients to FC 7.2.5, the clients Web Filter, Video Filter, Vulnerability, and System Events no longer populate in EMS at all.  These events don't update under the Endpoint Views for the clients and therefore the Vulnerability Dashboard does not show any information for detected Vulnerabilities either.  If you check the clients, they are definitely logging these events and, they are just no longer being populated in EMS.  I've checked every setting in EMS and on the Client configurations and I can not find out what is breaking this.  I've confirmed that the necessary ports are still open and that there are no filters in place to prevent them from showing in EMS.  The clients are still successfully updating everything else in EMS just not the event info.

 

Anyone else come across this and have a fix?

Best answer by FortiNet_Newb

To resolve this issue, I had to have all of my users re-register to EMS by sending them an invitation.  Once the users clicked the register link, event information started populating in EMS again.

 

The upgrade to 7.2.5 must have broke something.  It's just really odd as everything else was working normally, the clients were all showing as licensed and were still syncing profiles with the EMS server, EMS server was indicating they were managed, EMS was properly displaying and updating device information/status/features, etc.. 

2 replies

dingjerry_FTNT
Staff
dingjerry_FTNT
Staff
November 20, 2024

Hi @FortiNet_Newb ,

 

Could you please provide a screenshot of the web filter profile you used in the FortiClient in this issue?  

 

I want to check the Web Filter first for this logging issue.

FortiNet_Newb
FortiNet_NewbAuthor
New Member
November 20, 2024

Here you go:

 

WebProfile.png

dingjerry_FTNT
Staff
dingjerry_FTNT
Staff
November 20, 2024

Thanks. Could you please turn on those two options:

 

FCT-WF-Profile.png

FortiNet_Newb
FortiNet_NewbAuthorAnswer
New Member
November 27, 2024

To resolve this issue, I had to have all of my users re-register to EMS by sending them an invitation.  Once the users clicked the register link, event information started populating in EMS again.

 

The upgrade to 7.2.5 must have broke something.  It's just really odd as everything else was working normally, the clients were all showing as licensed and were still syncing profiles with the EMS server, EMS server was indicating they were managed, EMS was properly displaying and updating device information/status/features, etc.. 

Terms & ConditionsAccessibility statement