FortiAnalyzer 5.4.0 VM Settings Dashboard Increases Current Administrator Count

[tanr]

Hi All,

I'm testing out a FortiAnalyzer 5.4.0 VM, under VMware ESXi 6.0 U2.  I've set it up with a management network and wan access, loaded my license, etc.  Updated the VM virtual hardware from 7 to 11.  That all seems fine.  I haven't started sending logs to it or anything else.  Using Chrome (64-bit, latest version) to manage it through a host only NIC.

What I'm seeing that is odd (and could be my config) is that viewing the FAZ Settings>Dashboard, I'll see the Current Administrator count is at 2 (for my GUI connection and the CLI Console widget on the Dashboard).  Navigate to Settings>Admin>Administration page, then back to Settings>Dashboard.  The Admin count jumps to 3.  Repeat till you run out of memory if you like...

It seems like each time I navigate to the Dashboard a new CLI Console widget logs into the FAZ, and navigating away from the Dashboard doesn't cause the widget to log out.

Have others seen this?  I couldn't find anything on the forums regarding it.  If its already a known issue I won't worry about it (much).  If others haven't seen this, I'll do some tests to my config (like rolling back to the snapshot before I updated the virtual hardware) before reporting it.

Thanks.

[tanr]

Same issue with the the default VM hardware from the FortiAnalyzer's ovf template.

Anybody else seen this issue with GUI Dashboard increasing the admin user count?

[tanr]

FYI, I've reported this to TAC.  They've reproduced the issue and are passing it up the chain.

Amusingly, skimming through the 5.4.0 admin guide, on pg. 54 is a screen shot of the Admin Session List which shows 4 jconsole logins -- an example of this issue.

[emnoc]

what does your cli output show ?

(cli)

 diag sys admin-session status

 diag sys admin-session list

I don't see this behavior.

[tanr]

I'm seeing this with FAZ VM 5.4.0, when the Dashboard has the CLI Console widget.

If I navigate away from Dashboard (to Settings > Admin > Administrators) and back 5 times, this is what I'll see:

diag sys admin-session list

*** entry 0 *** session_id: 45788 (seq: 0) username: admin admin template: admin from: GUI(192.168.112.1) (type 1) profile: Super_User (type 3) adom: root session length: 114 (seconds) idle: 0 (seconds) *** entry 1 *** session_id: 15526 (seq: 1) username: admin admin template: admin from: jsconsole(192.168.112.1) (type 0) profile: Super_User (type 3) adom: root session length: 79 (seconds) *** entry 2 *** session_id: 55194 (seq: 2) username: admin admin template: admin from: jsconsole(192.168.112.1) (type 0) profile: Super_User (type 3) adom: root session length: 55 (seconds) *** entry 3 *** session_id: 18263 (seq: 3) username: admin admin template: admin from: jsconsole(192.168.112.1) (type 0) profile: Super_User (type 3) adom: root session length: 51 (seconds) *** entry 4 *** session_id: 22675 (seq: 4) username: admin admin template: admin from: jsconsole(192.168.112.1) (type 0) profile: Super_User (type 3) adom: root session length: 48 (seconds) *** entry 5 *** session_id: 60619 (seq: 5) username: admin admin template: admin from: jsconsole(192.168.112.1) (type 0) profile: Super_User (type 3) adom: root session length: 45 (seconds)

[emnoc]

Mine is not doing that but only  when you have  "cli console open". That's the java console that's probably dettach during the initial  connection and everytime you go back and forth you opening a new console which is normal.

try this, go into the dashboard and " remove the cli console widget" and re-try. Update us on what you find?

I tried a few  FGT and this behavior does not exist, only one javaconsole is open no matter how many times you reload the dashboard.

[tanr]

Yes, this is only a problem with the GUI Dashboard CLI Console widget (which is on the default dashboard).  If I remove the CLI console then there aren't multiple admin connections.

I see this issue with the CLI console widget attached (not as a separate detached window).  Haven't tested it detached.

You don't even need to click on the console to start an initial connection for this issue to show up.  It appears to be initiating a new connection each time the dashboard screen is loaded, without ever closing the old one.

This is not really a problem for me -- just reporting it.

[emnoc]

I should have used "connected". The  console when "connected"  in the dashboard will ALWAYS re-open if you go back and re-fresh the  main dashboard.

This would be like re-opening the console but the jsconsole. So if you login and DO NOT have the console "connected" the  console won't reopen if you toogel back and forth between views.

is that explained clearly?

Ken

[tanr]

Hi Ken,

I understand this happens when the jconsole (CLI Console widget) is a connected part of the dashboard.  I'm not actually all that surprised to see something like this, as its a common situation with UI initializations.

However, normal navigation between the FortiAnalyzer GUI pages (clicking Dashboard on the left side, clicking Administration, etc., without clicking the refresh button) really shouldn't cause multiple logins.  This is basically a GUI state bug which creates a small memory leak while the GUI is up.  Not a giant issue (and not a problem for me), but a possible problem for companies that leave browsers running the FAZ GUI for extended periods of time.