Deleting an Organization in Setup view - Data base error occures in FortiSIEM7.1.3

[KarlH]

Hello

over in Admin -Setup- Organization

the Error appeared when I tried to delete an organization, one of our clients who has terminated service.  Any ideas on what this is due to? or how I can fix? is this the Database being confused somehow?

Thanks in advance.

[Richie_C · Accepted solution]

Hi @KarlH 

It looks like you have some references in Global to the Org you are trying to delete. The screenshot specifically mentions rules. But it could be worth checking other references such as notification policies or admin accounts.

Regards

[Richie_C · Accepted solution]

Hi @KarlH 

It looks like you have some references in Global to the Org you are trying to delete. The screenshot specifically mentions rules. But it could be worth checking other references such as notification policies or admin accounts.

Regards

[KarlH]

OK @Richie_C thank you  I will seek those out sure will be nice to upgrade to a newer version of the Supervisor and SIEM where I'm sure the error message are far more human friendly and informative.

Also FYI its considered an vulnerability to expose back-end system errors to the user.. Fortinet really should not allow system errors to percolate to the human user.  Most likely a Try Catch mistake. Simulate scenarios where exceptions are thrown, and verify that user-friendly, non-sensitive error messages are displayed.

[KarlH]

I switched the SIEM from global to the organization in question, this is proving more complicated than I expected. I'm not sure what I'm looking for.  What are the tables specifically used for? in my initial query?  I'm suspicious this is not meant for the end user and I am not going to debug FortiSIEM.

[KarlH]

Receiving the error below after going to Admin, Setup and than Organisations and trying to delete an organization.  

----------------------------------------------------------------------------------

 Please make sure the following items in this org/collector are not needed and try removing them first.

Root cause: ERROR: update or delete on table "ph_drq_rule" violates foreign key.

constraint "fk391a2638ad87dc6d: on table "ph_dwl_rule_mapping"

Detail: key (id)=(10660979) is still referenced from table "ph_dwl_rule_mapping".

------------------------------------------------------------------------------------

So far I have heard to check notifications, notification policies, admin accounts and of course rules.

Where to go to delete them ? and how? LOL

[KarlH]

HI,

I cannot seem to get Fortinet to even respond to my ticket, this is Fortinet db issue and it needs assistance to clean it. I am not going to go into phoenixdb and start messing with this. Fortinet can you please respond to  my ticket 10093987.  Does this really take 9 days?   Thanks Karl

[ForrestF1re · Accepted solution]

Sorry for the bump on this, but checking in to see if any further update other than "Raise to TAC" was found? I'm currently facing this with two organizations in our FortiSIEM. Going to raise a TAC case myself. 

[KarlH]

Hey @ForrestF1re , no worries,   The hierarchy goes like this, and anyone please correct me,.

Org -> delete  rules (we have to switch to the org itself in the rules view the reports view and the notification view )

not the global setting in the upper right corner.

       delete   reports    ( again I am unclear, I accidentally deleted all the canned reports that came with 7.1.3, how do we know what to delete. ?

And if all else fails you create a TAC ticket and they go mess with the PSQL. 

[ForrestF1re]

Thanks Karl! Just had that as well, that error was... Interesting. 

But it worked, thanks for the help and understanding with it.