Troubleshooting Tip: FortiGuard management service license expiring log message

[emalayan]

Description	This article describes how to solve an issue where, even with a valid and up-to-date FortiGuard license, logs repeatedly state 'FortiGuard management service license expiring in X day(s)'. For example: date=2024-08-22 time=11:01:14 eventtime=1724288474499872081 tz="+1000" logid="0100032045" type="event" subtype="system" level="warning" vd="root" logdesc="FortiGuard management service license expiring" msg="FortiGuard management service license will expire in 5 day(s)"
Scope	Any FortiOS versions.
Solution	The FortiGuard management service is part of Fortinet's Security Operations (SecOps) solutions and requires a separate license. This is not included in the core FortiGuard Unified Threat Protection (UTP) license. It is likely that the Automation-Stitch 'License Expired Notification' is enabled and triggering the warning messages. To resolve this issue, look for the automation trigger that is causing the warning messages. In the GUI, go to Security Fabric -> Automation -> Trigger, then search for and edit the 'License Expired Notification' stitch. On the 'Edit Automation Trigger' page, select the drop-down menu for License and make sure that 'Any' is not selected. Instead, select 'FortiCare Support' or any preferred FortiGuard license. Alternatively, on the FortiGate CLI, apply the following commands: config system automation-trigger     edit "License Expired Notification"         set event-type license-near-expiry         set license-type {forticare-support or any of fortiguard-<license>}     next end