FortiAnalyzer can receive logs and Windows host events directly from endpoints connected to EMS, and you can use FortiAnalyzer to analyze the logs and run reports.
This article describes how to handle scenarios where FortiAnalyzer reports and report templates are missing or not loading.
Scope
FortiAnalyzer.
Solution
When FortiAnalyzer reports and report templates/charts are not present under the Reports/Chart/Dataset page, it usually suggests that the FortiAnalyzer configuration is either corrupted or there is configuration loss. This occurrence is usually caused by firmware downgrade which is not supported.
To check whether or not there was a firmware downgrade done (be aware that downgrade is not supported and always use the upgrade path tool), run the CLI command 'diag cdb upgrade summary'. Below is an excerpt of the CLI output showing there was a firmware downgrade from v7.4.1 to version v7.2.4.
Users may try to run the following CLI commands in an attempt to recover the missing report and report templates/charts:
diag faz-cdb fix fix-report-folder<----- Adom name or all if all ADOMs are affected.
If step 3 does not work, run the following CLI command to reset the cdb config to revert it to the default settings. Since the cdb config contains all the custom report settings and event handlers, be sure to export them as a backup before resetting the cdb config.
diag faz-cdb reset
It is possible to create a new ADOM and export the necessary provided template from this new ADOM to use to the current empty ADOM.
If the above steps do not work, the last resort is to fully reset and format FortiAnalyzer.
