Description
This article describes the behavior of FortiGate losing the FortiAnalyzer serial number from the settings.
Scope
FortiGate.
Solution
In this example, FortiGate runs in v7.2.8 managed by FortiManager v7.2.5, where the FortiAnalyzer IP address and Serial Number are configured using the FortiManager system template.
The behavior is triggered randomly and once the FortiManager notices that the serial has disappeared tries to push it again.
config log fortianalyzer setting
set status enable
set server "10.10.10.10"
set upload-option realtime
set reliable enable
end
Considering that the behavior is intermittent the issue can be reproduced by using one of the methods below:
- By killing the OFTP daemon on the FortiGate.
- On the FortiGate, find and clear the FortiAnalyzer session in the CLI:
diag sys session filter dst x.x.x.x <---- Replace with the FortiAnalyzer IP address.
diag sys session clear
A new session is visible with:
diag sys session list
Check if the FortiAnalyzer serial number is missing with the following command:
show full log fortianalyzer setting
When the issue is encountered, another prompt will appear to verify the FortiAnalyzer serial number and certificate.
Workaround:
Verify/accept the FortiAnalyzer certificate again or push the Serial Number using a CLI Script.
If requirements are met, run the following debug commands and raise a ticket with the TAC support team to further analyze the output.
diag debug reset
diag debug console timestamp enable
diag debug enable
diag debug app fgtlogd -1
As soon as the issue occurs, stop fgtlogd debugging with the commands below:
diag debug disable
diag debug app fgtlogd 0
diag debug reset
Check the debug outputs:
write config file success, prepare to save '/tmp/system.conf.8075.MyEyZO' to '/data/./config/sys_global.conf.gz' on flash
flash: block_sz=4096, free_blocks=31059
[__create_file_new_version:293] the new version config file '/data/./config/sys_global.conf.gz.v000002957' is created
[symlink_config_file:360] a new version of '/data/./config/sys_global.conf.gz' is created: /data/./config/sys_global.conf.gz.v000002957
[symlink_config_file:404] the old version '/data/./config/sys_global.conf.gz.v000002956' is deleted
[symlink_config_file:406] '/data/./config/sys_global.conf.gz' has been symlink'ed to the new version '/data/./config/sys_global.conf.gz.v000002957'. The old version '/data/./config/sys_global.conf.gz.v000002956' has been deleted
zip config file /data/./config/sys_global.conf.gz success!
This problem is tracked under bug 1083537 and is resolved in v7.2.11, v7.4.8, v7.6.1 (and newer).
