FortiSIEM
FortiSIEM provides Security Information and Event Management (SIEM) and User and Entity Behavior Analytics (UEBA)
mbenvenuti
Staff
Staff
Article Id 375973
Description This article describes how to update hardware ID changes.
Scope FortiSIEM.
Solution

When the FortiSIEM VM is cloned or moved to another host, the hardware ID will change. As the hardware ID sets the license, the license needs to be updated for the FortiSIEM to keep running.

Here are the steps:

 

  1. Check if the Hardware ID differs from the license:Access to the FortiSIEM super CLI as root:

 

phgetUUID

UUID: B17C2042-A493-D6EB-23BA-7C9BE4B5F3CB

phLicenseTool --show | grep "^Hardware"

Hardware ID 01E72042-BEFE-354B-3896-A53907492F71

 

If the hardware ID differs, please continue with the next steps. If not, no need to update the Hardware ID or the license.

 

  1. Update the hardware ID in the database: from super CLI as root:

 

hwid=`phgetUUID`

psql -U phoenix phoenixdb -c "update ph_sys_conf set value='$hwid' where property = 'hardware_id';"

 

  1. Update the license from the Fortinet Support Portal: go to the Product list and select the serial number:

product_list.png

 

  • Select 'Edit':

 

edit_product.png

 

  • Edit the hardware ID and save:

 

edit_hw_id.png

 

  • Download the new license:

 

download_license.png

 

  1. Upload the license to the FortiSIEM at https://super_IP/phoenix/licenseUpload.jsf
  2. Check the processes with phstatus command and all services should start up.
Contributors