Technical Tip: How to retrieve logs from FortiSIEM VA and deliver them to support

[Andy_G]

Description

This article describes how to package the FortiSIEM logs to deliver them to support. 

Scope

FortiSIEM.

Solution

This is a step-by-step guide on how to collect log files over a certain period and send them to a FortiSIEM support team. 

1. Extract and Compress Logs:
   1. SSH into the Supervisor, Worker/ or Collector as root.
   2. Enter the following commands:

get-fsm-health.py --local -o /tmp/fsm-health.log

journalctl -k --no-pager > /tmp/journlctl.log

env > /tmp/root_env

su admin -c env > /tmp/admin_env

phziplogs /tmp/<ticket_number> <number_of_days>

This will create a directory with a ticket number as well as collect logs for the number of days to go back to.

Being able to pick up historical events will be critical if an issue occurs in the past. Make sure to know how many days are necessary. For example: phziplogs /tmp/1234 5.

The log name will appear as AOLogs.tar, in /tmp/<ticket number>/.

1. 1. Change the filename of AOLogs.tar to a more unique name (e.g. FortiSIEMLogs-SP-20181119.tar for Supervisor Logs on November 19th, 2018).
2. 1. cd /tmp/1234
   2. tar --append --file=AOLogs.tar /tmp/fsm-health.log
   3. tar --append --file=AOLogs.tar /tmp/journlctl.log
   4. tar --append --file=AOLogs.tar /tmp/root_env
   5. tar --append --file=AOLogs.tar /tmp/admin_env
   6. mv AoLogs.tar <new file name>

1. 2. Repeat steps 1.a. thru 1.c. for all Collectors, Workers, and Supervisors.
      
      

2. From the FortiSIEM appliance, directly SCP the log to the desktop.

   1. For Windows users, use Winscp to pull the logs from the /tmp directory of the fortiSIEM appliance.
      

   2. For Linux users, use SCP from the FortiSIEM bash prompt to copy it out to the local desktop.

      
      $ scp -r <local directory> username@<host_ip>:<remote directory>
      
      
   3. Upload the file to the support ticket at support .fortinet.com.
      
      

3. Log into the Fortinet support account.

   1. Find the ticket associated with the log request upload. 

   2. Upload the attachment to the ticket with a response (Note that the upload limit is 500MB per attachment).