Active Logstore does not link to any Device

[Pham_Phu_Cuong]

Hi everyone,

I'm using FAZ-VM64 v5.2.3. I have one logstore that is still active but does not link to any Device, so it keeps generating "did not receive any log". Anybody have any ideas how to deal with it. Can I safely use the "execute log device logstore clear" to get rid of it. How come it doesn't become a zombie but still a active one. 

By the way, is there a way to view to which device does which logstore link to?

For your information, this is how I got to this point:

  - Fortigate was in standalone mode, connected to FAZ as a standalone device

  - Fortigate was configured to be in HA mode

  - the second Fortigate show up in FAZ as an unregistered Fortigate this time as a HA cluster (HA cluster enabled without any other device)

  - right clicked to add the second Fortigate (as a HA cluster, without noticing)

  - edited the first FGT to enable the HA cluster, about to add the 2nd FGT just to realize it's not available for adding (because it's already an HA cluster)

  - disable the HA cluster on the second FGT  **

  - again edited the first FGT to enable the HA cluster , successfully added the 2nd FGT to the cluster

  - deleted the standalone 2nd FGT (thought it would disappear when added to the HA cluster, but it didn't)

** this might be where the unlink but active logstore occurs. There are still zombie logstores but it doesn't generate annoying events.

Also I have already read this thread https://forum.fortinet.com/tm.aspx?m=121482 but this is sth different.

Any ideas are welcome.

Thanks,

Cuong

[scao_FTNT]

can you provide "diag log device" and "diag dvm device list"? you can message me the result

Thanks

Simon

[Pham_Phu_Cuong]

I'm afraid those output contains information that I won't be able to share.

Sorry

[Pham_Phu_Cuong]

Is the bug id 355753 in this v5.2.6 release-notes related to this issues?

http://docs.fortinet.com/uploaded/files/2964/fortianalyzer-v5.2.6-release-notes.pdf

[scao_FTNT]

can you open a ticket and attach info there? you can message me the ticket ID and I will take a look there

Thanks

Simon