FortiSIEM
FortiSIEM provides Security Information and Event Management (SIEM) and User and Entity Behavior Analytics (UEBA)
alaxkar
Staff
Staff
Article Id 399529
Description This article describes how to disable SELinux temporarily or permanently on Linux-based servers. 
Scope FortiSIEM.
Solution

On certain Linux distributions, SELinux is activated by default and operates in Enforcing mode. As a consequence may face such issues:

  1. The agent cannot identify which log types it should collect.
  2. It fails to send any logs to the Supervisor.

 

Workaround:

This can permanently disable or put it in Permissive mode.

 

Step1: Check the SELinux status.

 

sestatus

 

sestatus.png

 

Step2: Set SELinux permissive temporarily. 

 

setenforce 0

 

Or, disable SELinux permanently:


sed -i 's/enforcing/disabled/g' /etc/selinux/config


Step3:

To make these changes, reboot the server:

 

reboot

 

After reboot, check with the 'sestatus' command to check SELinux status. 

 

Contributors