| Solution |
Prerequisites:
- From FortiSIEM - Create a new agent user account:
- For Enterprise: Go to CMDB -> Users -> FortiSIEM Users -> New -> Add User Name, Select the pencil icon beside System Admin, checkmark Agent Admin, add password, and Save.
- For Service Provider: Go to Global View -> Admin -> Setup -> Organization -> Select the Organization -> Edit -> Agent User: Enter a username, Agent Password: Enter a password -> Save.
- Collect the Organization's information from Admin -> Setup -> Organization (Organization Name and Organization ID).
- From Linux Host:
- Make sure the software and package requirements are installed, depending on the OS version.
FortiSIEM Linux Agent
- Test connection from host to Supervisor on port 443:
wget --no-check-certificate https://<SUPER_IP>:443
-
- Run the Installation script:
bash fortisiem-linux-agent-installer-7.x.xxxxxxsh -s <SUPER_IP> -i <ORG_ID> -o <ORG_NAME> -u <AGENT_USER> -p <AGENT_PWD> -n <HOST_NAME>
-
- The script will register the agent successfully if all the prerequisites are correct.
If the script finds an issue, it will prompt an error message indicating the cause of the failure.
Troubleshooting:
There are 3 main reasons for the registration to fail:
- The package requirements are not installed in the host, or the OS version is not supported.
- The registration information, including Supervisor IP/FDQN, username, password, Orgname, and OrgID, is incorrect.
- Connection issues include network configuration/communication on port 443, NAT, SSL inspection, external firewall rules blocking, certificate configuration, etc.
- Review the Debugging information available in two log files:
/opt/fortinet/fortisiem/linux-agent/log/fortisiem-linux-agent.log
/opt/fortinet/fortisiem/linux-agent/log/phoenix.log
If error codes 401 and 403 are found, review registration information, such as the ORG name, ORG ID, agent username, and password. If necessary, create a new agent user account.
- Check supervisor logs to confirm the host connection reaches the Supervisor. SSH to Supervisor:
cat /etc/httpd/logs/ssl_access_log | grep <host_IP>
Review the HTTP status code.
- Leave the tail command running in Supervisor and run the installation on the host:
tail -f /opt/glas*/dom*/dom*/logs/phoenix.log
Registration log entries should be received.
For example:
If no registration logs are showing in the phoenix.log, the host is not reaching the Supervisor on port 443. Check network configuration.
|
