FortiSIEM
FortiSIEM provides Security Information and Event Management (SIEM) and User and Entity Behavior Analytics (UEBA)
RuiChang
Staff
Staff
Article Id 374991
Description

 

This article describes how to troubleshoot when the FortiSIEM Image Server upload image is not functioning after the image is finished loading.

 

Scope

 

FortiSIEM.

 

Solution

 

In ForitSIEM GUI, go under Admin -> Settings -> Image Server. It provides users the option to upload images of Collectors, Windows Agents, and Linux Agents for mass upgrade.

 

RuiChang_0-1738811550214.png

 

After finishing loading, users should see the zip file shown in the GUI. Besides, users can further check the backend of FortiSIEM at the path below to verify the image is uploaded to FortiSIEM Supervisor successfully:

 

#ls -la /opt/phoenix/WinAgentUpgrade 

 

In some cases, users may face issues where the image uploaded is not found in the GUI or CLI after finishing loading. No error will be shown in the GUI and the GUI remain empty. Hence, users need to open the browser debug to troubleshoot further and should see the error below:

 

RuiChang_0-1738811571524.png

 

It indicates the image file exceeded the HTTP size and failed to upload via the GUI. Hence, users need to apply the solution below:

 

  • Go to path below:

 

#cd /etc/httpd/conf.d/

 

  • Edit file below:

 

#vi mod_security.conf

  • Increase the value below:

Before:


SecRequestBodyLimit 1000000000
SecRequestBodyNoFilesLimit 131072
SecRequestBodyInMemoryLimit 131072
SecRequestBodyLimitAction Reject

After:


SecRequestBodyLimit 2147483648
SecRequestBodyNoFilesLimit 2147483648
SecRequestBodyInMemoryLimit 2147483648
SecRequestBodyLimitAction ProcessPartial

  • Save the file:


:wq!

After that, users can try to upload the images again.

 

Note:

A clear browser cache is recommended to apply the latest value.

 

Related documents:

System Settings

Technical Tip: How to upgrade collectors from the FortiSIEM Image Server Page

 

Contributors