Seeking advice for re-install of VM (All in One type) Collector only Azure cloud,

[KarlH]

The customer has lost their collector LOGIN password we needed to login to clean the disk space from needless clickhouse service running now we have to re-install unless there is a safe procedure on the collector for Rocky Linux to reset the password. Has Anyone done this?

The clients collector presently is  7.1.3.0165  was running on Azure Cloud VM

Our super is 7.1.3

If I cant reset the password then;

We are new to the install procedures, ( i.e Ive never done an install before)  I'm seeking advice on the most stable version to install? do we use 7.1? or 7.2?

Collector VM is on Azure (Cloud). Would the setup be the same  process as onPrem VM?

Which All in One build do I download from here?

https://support.fortinet.com/support/#/downloads/firmware

Thank you , really need the help.

[FSM_FTNT · Accepted solution]

If you want to install an earlier 7.1.x version of FSM Collector you should be able to deploy from here

Use the app offer instead of vm offer

https://azuremarketplace.microsoft.com/en-us/marketplace/apps/fortinet.fortinet-fortisiem?tab=Overvi...

[premchanderr]

Hi @KarlH ,

To know the linux OS version enter a terminal and type "lsb_release -a" or "cat /etc/os-release."

Then you need to involve Linux Administrator and check linux forums to reset root password.

Since its third party links I cannot post it in Fortinet forum.

The collector must be same version as supervisor or n-1 version of supervisor. Never a higher version of collector would sync well with supervisor.  

Regarding image it is same for all FortiSIEM Nodes ( super,worker or collector) . Example if hypervisor is ESX then have to choose FSM_Full_All_ESX_7.2.3_build0256.zip. If Azure hypevirsor then FSM_Full_All_AZURE_7.2.3_build0256.zip etc 

Do refer the installation document to know detailed steps:

https://docs.fortinet.com/document/fortisiem/7.2.3/azure-installation-guide/496685/fresh-installatio...

https://docs.fortinet.com/document/fortisiem/7.2.3/esx-installation-guide/131018/fresh-installation

[KarlH]

Hello, 

Our supervisor is 7.1.3 not 7.2.3. I found a collector FSM_Full_All_ESX_7.1.3_build0165.  But it seems to imply that I need to install 6.5 and then 6.2, As I mentioned they have a 6.5 installed now and no root access. Is there a full fresh install for 7.1.3 collector?.  They have lost their pw and cannot log on, re-deploy is only option,  They had 6.5 presently but no way to login. Does this mean we have to reinstall 6.5 then 6.7 and then 7.1.3?

Also for the Azure config, they are running a VM within  the Azure cloud would that not still be the

an .ova file for VMWare?

[premchanderr]

Hi @KarlH ,

You can directly install a new collector from 7.1.3 and then register the collector to super. Move all the devices to latest collector and then delete the old collector. 

You can "Create a VM Using a FortiSIEM7.2.3Azure Marketplace Image" this is simpler and easy method.

[KarlH]

Ok thank you Prem,

Shouldn't Fortinet have the collector images already?  I'm not comfortable creating an image of a collector for the customer that seems prone to errors on my part prolonging getting them back up and running. I know little about creating a collector image.

Maybe you meant FortiSIEM 7.1.3 Azure not 7.2.3 as I mentioned that is the version on the super. I have never used  Market place to create an image I have alway downloaded the iso or ova from the vendor who supports the content.

I gave  the client the ESX 7.1.3 ova and the PDF already. 

[FSM_FTNT · Accepted solution]

If you want to install an earlier 7.1.x version of FSM Collector you should be able to deploy from here

Use the app offer instead of vm offer

https://azuremarketplace.microsoft.com/en-us/marketplace/apps/fortinet.fortinet-fortisiem?tab=Overvi...

[KarlH · Accepted solution]

Thank you.