Deleting an Organization in Setup view - Data base error occures in FortiSIEM7.1.3

[KarlH]

Hello

over in Admin -Setup- Organization

the Error appeared when I tried to delete an organization, one of our clients who has terminated service.  Any ideas on what this is due to? or how I can fix? is this the Database being confused somehow?

Thanks in advance.

[Richie_C · Accepted solution]

Hi @KarlH 

It looks like you have some references in Global to the Org you are trying to delete. The screenshot specifically mentions rules. But it could be worth checking other references such as notification policies or admin accounts.

Regards

[KarlH]

OK @Richie_C thank you  I will seek those out sure will be nice to upgrade to a newer version of the Supervisor and SIEM where I'm sure the error message are far more human friendly and informative.

Also FYI its considered an vulnerability to expose back-end system errors to the user.. Fortinet really should not allow system errors to percolate to the human user.  Most likely a Try Catch mistake. Simulate scenarios where exceptions are thrown, and verify that user-friendly, non-sensitive error messages are displayed.

[KarlH]

I switched the SIEM from global to the organization in question, this is proving more complicated than I expected. I'm not sure what I'm looking for.  What are the tables specifically used for? in my initial query?  I'm suspicious this is not meant for the end user and I am not going to debug FortiSIEM.

[KarlH]

Receiving the error below after going to Admin, Setup and than Organisations and trying to delete an organization.  

----------------------------------------------------------------------------------

 Please make sure the following items in this org/collector are not needed and try removing them first.

Root cause: ERROR: update or delete on table "ph_drq_rule" violates foreign key.

constraint "fk391a2638ad87dc6d: on table "ph_dwl_rule_mapping"

Detail: key (id)=(10660979) is still referenced from table "ph_dwl_rule_mapping".

------------------------------------------------------------------------------------

So far I have heard to check notifications, notification policies, admin accounts and of course rules.

Where to go to delete them ? and how? LOL

[KarlH]

HI,

I cannot seem to get Fortinet to even respond to my ticket, this is Fortinet db issue and it needs assistance to clean it. I am not going to go into phoenixdb and start messing with this. Fortinet can you please respond to  my ticket 10093987.  Does this really take 9 days?   Thanks Karl