Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
KarlH
Contributor

Deleting an Organization in Setup view - Data base error occures in FortiSIEM7.1.3

 

Hello

 

over in Admin -Setup- Organization

the Error appeared when I tried to delete an organization, one of our clients who has terminated service.  Any ideas on what this is due to? or how I can fix? is this the Database being confused somehow?

 

 

Datbaseerror.png

 

Thanks in advance.

 

 

 

Karl Henning, Security Engineer, CISSP
Karl Henning, Security Engineer, CISSP
1 Solution
Richie_C
Staff
Staff

Hi @KarlH 

 

It looks like you have some references in Global to the Org you are trying to delete. The screenshot specifically mentions rules. But it could be worth checking other references such as notification policies or admin accounts.

 

Regards

Take a backup before making any changes

View solution in original post

5 REPLIES 5
Richie_C
Staff
Staff

Hi @KarlH 

 

It looks like you have some references in Global to the Org you are trying to delete. The screenshot specifically mentions rules. But it could be worth checking other references such as notification policies or admin accounts.

 

Regards

Take a backup before making any changes
KarlH
Contributor

OK @Richie_C thank you  I will seek those out sure will be nice to upgrade to a newer version of the Supervisor and SIEM where I'm sure the error message are far more human friendly and informative.

 

Also FYI its considered an vulnerability to expose back-end system errors to the user.. Fortinet really should not allow system errors to percolate to the human user.  Most likely a Try Catch mistake. Simulate scenarios where exceptions are thrown, and verify that user-friendly, non-sensitive error messages are displayed.

Karl Henning, Security Engineer, CISSP
Karl Henning, Security Engineer, CISSP
KarlH

I switched the SIEM from global to the organization in question, this is proving more complicated than I expected. I'm not sure what I'm looking for.  What are the tables specifically used for? in my initial query?  I'm suspicious this is not meant for the end user and I am not going to debug FortiSIEM.

Karl Henning, Security Engineer, CISSP
Karl Henning, Security Engineer, CISSP
KarlH
Contributor

 

Receiving the error below after going to Admin, Setup and than Organisations and trying to delete an organization.  

----------------------------------------------------------------------------------

 Please make sure the following items in this org/collector are not needed and try removing them first.

Root cause: ERROR: update or delete on table "ph_drq_rule" violates foreign key.

constraint "fk391a2638ad87dc6d: on table "ph_dwl_rule_mapping"

Detail: key (id)=(10660979) is still referenced from table "ph_dwl_rule_mapping".

------------------------------------------------------------------------------------

 

So far I have heard to check notifications, notification policies, admin accounts and of course rules.

Where to go to delete them ? and how? LOL

 

 

Karl Henning, Security Engineer, CISSP
Karl Henning, Security Engineer, CISSP
KarlH
Contributor

HI,

 

I cannot seem to get Fortinet to even respond to my ticket, this is Fortinet db issue and it needs assistance to clean it. I am not going to go into phoenixdb and start messing with this. Fortinet can you please respond to  my ticket 10093987.  Does this really take 9 days?   Thanks Karl

Karl Henning, Security Engineer, CISSP
Karl Henning, Security Engineer, CISSP
Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors