Troubleshooting Tip: Windows Agent registered with Supervisor but not uploading events

[flunaibarra]

Description	This article describes troubleshooting steps to undertake when a Windows Agent is registered with a Supervisor but not uploading events to a Collector. Before proceeding, review the compatibility matrix to verify that the correct Windows/Linux agent version is registered with a compatible Supervisor and Collector version.
Scope	Windows Agent from v4.4.x to v7.3.x. Supervisor and Collector from v6.x to v7.3.x.
Solution	Prerequisites: The Agent registered successfully with the Supervisor. In CMDB, the host Status shows as Approved. Agent Monitor Templates should already be created. See the Define the Agent Monitor Templates configuration: Host-to-template associations should already be created. See the Associate Windows Agents to Templates configuration. Make sure to press the 'Apply' button between the Delete and Up sections in the host template association section. Note: If the Apply button is not pressed, the changes are not sent to the agent. Troubleshooting: Understanding 3 connection communication flow: The Agent uses the outbound HTTPS (443) to register with the Supervisor and send updates (Registration and Updates): https://<SupervisorIP/FQDN>:443/phoenix/rest/register/windowsAgent https://<SupervisorIP/FQDN>:443/phoenix/rest/windowsAgent/update After the template association is applied, the Agent uses the outbound HTTPS (443) to the Collector to upload the events (Upload events): https://<CollectorIP/FQDN>:443/winupload_direct? <AgentID> Collector Upload events to Supervisor by HTTPS (443). Cause 1: Issue with connection from Collector to Supervisor. Make sure the Collector's Health Status shows as Normal and the Last File Received is updating. If there is an issue with Collector, see this article Troubleshooting Tip: How to troubleshoot collector issues to review the common Collector's issues. Cause 2: Agent not uploading the events to the assigned Collector. When the template association is applied, the agent will use this Collector IP/FQDN to upload the events. As a result, the agent should be able to reach/connect to this Collector IP or FQDN using port 443. Test the connection from the host to the Collector on port 443 with the following command in Powershell: Test-NetConnection <Collector_IP> -port 443 The result should show 'TcpTestSucceded = True'. If the result is 'TcpTestSucceded = False', check the network configuration. Cause 2.1: The Collector is configured with Private and Public IPs. If the Collector IP in the Health tab is a Private IP and the agent needs to use the Public IP instead, use the Virtual Collector option from the Template Association configuration and enter the Public IP -> Save. Note: Make sure to press the 'Apply' button. Cause 3: Network configuration causing the connection issue. Run the following command to confirm the host is reaching the Collector and verify the HTTP codes: cat /etc/httpd/logs/ssl_access_log | grep <HOST_IP> If there are no logs, remove the filter host's IP and check if agent traffic is reaching the Collector. The traffic might be sent with a different host IP, depending on the networking configuration. cat /etc/httpd/logs/ssl_access_log Cause 4: Super list causing IP conflict. If a Supervisor IP or FQDN is configured under Admin -> Settings -> System -> Cluster Config -> Supervisors. This IP/FQDN will be sent to the Agent, creating an IP conflict. To confirm this, in the Windows host, open RegEdit -> HKEY_LOCAL_MACHINE\Software\Fortinet\FortiSIEM. Solution 1: Remove the IP/FQDN from Admin -> Settings -> System -> Cluster Config -> Supervisors. In the RegEdit -> Select the 'supers' register and remove the IP/FQDN. Restart the FSMLogAgent Process: Open Task Manager -> Processes -> Select FSMLogAgent -> End task. The process will start automatically. Solution 2: If the Supervisor IP/FQDN is needed in the Cluster Config tab, then Uninstall the Agent by running the FSMLogAgent.exe and click Uninstall as the Agent Installation Guide indicates. Rerun the installation/registration and use the Supers Override Option from the Registration Window, entering the same Supervisor IP that is used for registration. For example: Cause 5: No Agent traffic reaching the Collector. On Collector run: tail -f /etc/httpd/logs/ssl_access_log | grep <HOST_IP> If there is no traffic reaching the Collector, change the Agent log level to Debug mode and review what IP the Agent is using to upload the events: Open Notepad as an Administrator. Open the file C:/Program Files/Fortinet/FortiSIEM/log4net.config. Replace <LogLevel>ERROR</LogLevel> with <LogLevel>DEBUG</LogLevel> and Save. Wait for 5/10 minutes for the logs to be collected. Check the Agent Application log, which is located in C:\ProgramData\FortiSIEM\Agent\Logs\Trace.log. Review errors or which IP/FQDN the Win Agent is using to upload the events. For example: The agent will try the Collector IP and FQDN that shows in the Collector Health tab. Make sure the Windows host can resolve the Collector FQDN, or add the IP that the agent needs to use in the Host to Template Association -> Virtual Collector as indicated in Cause 2.1 Note: Revert the changes in the log4net.config file to <LogLevel>ERROR</LogLevel>.