This article describes how to resolve an issue where the FortiSIEM Linux Agent shows a 'Disconnected' status on the Supervisor, or when the agent registers successfully but does not appear in the CMDB.
Scope
FortiSIEM v7.0.X, v7.1.X, 7.2.X, Linux host OS: RHEL 9.5 or Rocky Linux 9.5.
Solution
Root cause:
On some Linux operating systems, SELinux (Security-Enhanced Linux) is enabled by default in Enforcing mode.
This may block the FortiSIEM Linux Agent (FSM) from writing its template file on the host system.
As a result:
The agent is unable to determine which log types to collect.
No logs are sent to the Supervisor.
The agent status remains 'Disconnected'.
Workaround:
Temporarily switch SELinux to Permissive mode. Once the Linux Agent becomes active and starts sending logs, revert SELinux to Enforcing mode. The agent will remain in a 'Running Active' state.
Change SELinux status to 'permissive' using the following command:
