FortiAnalyzer Cloud does not show a Fortigate although the device is connected

[mhaneke]

Hello,

a FortiAnalyzer Cloud7.4.3 b5573 does not show a FortiGate 7.4.3 b2573 although the device is connected. I checked the serial number of the cloud instance and it matches with that one connected to the Fortigate.

On the Fortigate I can switch in Log -> Forward Traffic to the Fortianalyzer and it presents all events. in the FortiAnalyzer Cloud account it says Quota is at 73%, but there are 0 devices shown.

But in the local events I see the most recent events which came from the Fortigate. Also in Log View -> Log Browse I can display the older logs from yesterday on back to archived logs from months ago.

In FortiView in Fortianalyzer Cloud it says Invalid params: No valid fabric member found.

best regards

Martin

[dbhavsar]

Hello @mhaneke ,

Can you please share output of following command from FortiGate:
exec log fortianalyzer test-connectivity

[mhaneke]

Hello @dbhavsar 

(global) # execute log fortianalyzer test-connectivity
No FAZ is enabled.

and

(root) # execute log fortianalyzer test-connectivity
No FAZ is enabled.

But why does it show:

best regards

Martin

[tpatel]

Hello mhaneke
can you please provide output of below command.
exec log fortianalyzer-cloud test-connectivity
config log fortianalyzer-cloud setting
show full

[mhaneke]

Hello @tpatel 

that command does not exist.

best regards

Martin

[mhaneke]

But

 (setting) # show
config log fortianalyzer-cloud setting
set status enable
set serial "FAZVCLTM24000703"
end

[tpatel]

Hello Martin,
Can you please tell us what firmware version you are using.
Can you please tell us what error you are getting when you use below command. 

#exec log fortianalyzer-cloud test-connectivity.       ----> we need to use cloud because fortigate analyzer cloud connection.

Please click on below link and reference document.

https://community.fortinet.com/t5/FortiAnalyzer/Technical-Tip-How-to-connect-FortiGate-to-FortiAnaly...

[mhaneke]

Hello @tpatel 

as mentioned above FortiAnalyzer Cloud7.4.3 b5573 and FortiGate 7.4.3 b2573

exec log fortianalyzer-cloud test-connectivity

FortiAnalyzer Host Name: FAZVM64-VIO-CLOUD
FortiAnalyzer Adom Name: root
FortiGate Device ID: FGT61FTK21018891
Registration: registered
Connection: allow
Adom Disk Space (Used/Allocated): 84193357317B/429496729600B
Analytics Usage (Used/Allocated): 67878030672B/171798691840B
Analytics Usage (Data Policy Days Actual/Configured): 100/100 Days
Archive Usage (Used/Allocated): 16315326645B/257698037760B
Archive Usage (Data Policy Days Actual/Configured): 150/365 Days
Log: Tx & Rx (613 logs received since 15:40:45 08/10/24)
IPS Packet Log: Tx & Rx
Content Archive: Tx & Rx
Quarantine: Tx & Rx

Certificate of Fortianalyzer valid and serial number is:FAZVCLTM24000703

best regards

Martin

[mhaneke]

Hello @tpatel ,

I ran the diags from the mentioned document with the following results

diagnose test application forticldd 3
Debug zone info:
FAZCLOUD:
Domain:GLOBAL
Home log server: 173.243.132.92:514
Alt log server: 173.243.132.72:514
Active Server IP: 173.243.132.92
Active Server status: unknown
Log quota: 500000000MB
Log used: 0MB
Daily volume: 1000000MB
fams archive pause: 0
APTContract : 1
APT server: 83.231.212.156:514
APT Altserver: 83.231.212.152:514
Active APTServer IP: 83.231.212.156
Active APTServer status: up

diag test app miglogd
mem=0, disk=22527171, alert=0, alarm=0, sys=22530000, faz=0, faz-cloud=22529749, webt=0, fds=0
interface-missed=4300

diag log kernel-stats
fgtlog: 2
fgtlog 0: total-log=11952081, failed-log=0 log-in-queue=0
fgtlog 1: total-log=10598435, failed-log=0 log-in-queue=0

diag test app fgtlogd 4
Queues in all miglogds: cur:3 total-so-far:2172239
global log dev statistics:
faz=0, faz_cloud=22529919, fds_log=0
faz-cloud: sent=22321960, failed=0, cached=0, dropped=209324
Num of REST URLs: 20
/api/v2/monitor/system/csf/?vdom=* : time_interval=300
global: : 603
/api/v2/cmdb/firewall/address/ : time_interval=1200
root: 46a59338a735bbe1d1179d6584948fe1 : 15893491
PolicyBased: ca351c78e52b52563ef7f7ce32ad1a9f : 15893491
/api/v2/cmdb/firewall/address6/ : time_interval=1200
root: e671d26c97968e29737b6de6e3b621c4 : 15893491
PolicyBased: 2fdcf324924b50cb16e534adf93224ae : 15893491
/api/v2/cmdb/firewall/addrgrp/ : time_interval=1200
root: 9f11f15ec8ff850a635149b82bf53091 : 15893491
PolicyBased: 7692880b84146a0736bcb663d2b6cb3e : 15893491
/api/v2/cmdb/firewall/addrgrp6/ : time_interval=1200
root: 0e84e4f78bcb52f46205572232d72782 : 15893491
PolicyBased: 99539070676dc2ae95a679f6b74d9acd : 15893491
/api/v2/cmdb/firewall/vip/ : time_interval=1200
root: 74d6591eefa6f5f2c0bd4c1e739ddce6 : 15893491
PolicyBased: 2e53880c292868f10d9b63b46d6123fc : 15893491
/api/v2/cmdb/firewall/vip6/ : time_interval=1200
root: 6a0388bb018ab42bc3dc77a38eb46b80 : 15893491
PolicyBased: 75a947e8db1cf09d4c16651d2a702245 : 15893491
/api/v2/cmdb/firewall/vip46/ : time_interval=1200
root: 1695d672b28a4f8ce61083ba8a96319b : 15893491
PolicyBased: a911ba893d72be273840421617b470d5 : 15893491
/api/v2/cmdb/firewall/vip64/ : time_interval=1200
root: 1695d672b28a4f8ce61083ba8a96319b : 15893491
PolicyBased: a911ba893d72be273840421617b470d5 : 15893491
/api/v2/cmdb/firewall/vipgrp/ : time_interval=1200
root: b6434ee9d8762e406068806d473eab2d : 15893491
PolicyBased: a4786366d351be770a66509d695866c0 : 15893491
/api/v2/cmdb/firewall/vipgrp6/ : time_interval=1200
root: 7e8b0cdcc335fbd9db18068efd6e6350 : 15893491
PolicyBased: ef50549e56614df4e6cddae0ef314ecd : 15893491
/api/v2/cmdb/firewall/vipgrp46/ : time_interval=1200
root: 1695d672b28a4f8ce61083ba8a96319b : 15893491
PolicyBased: a911ba893d72be273840421617b470d5 : 15893491
/api/v2/cmdb/firewall/vipgrp64/ : time_interval=1200
root: 1695d672b28a4f8ce61083ba8a96319b : 15893491
PolicyBased: a911ba893d72be273840421617b470d5 : 15893491
/api/v2/cmdb/system/saml : time_interval=300
global: 99f6b2c1fd767e49f1802486597b262a : 15923607
/api/v2/cmdb/system/automation-trigger : time_interval=1200
global: 5d365939ce4ee8fd032c6fc30db52837 : 15893491
/api/v2/cmdb/system/automation-action : time_interval=1200
global: f85ec8375803fe6c5b726047c7ae791e : 15893491
/api/v2/cmdb/system/automation-stitch : time_interval=1200
global: cd8e101e7c520dd96e4e5066dc70e87a : 15893491
/api/v2/cmdb/system/sdwan/ : time_interval=1200
root: 930f54c353a1d5d7c58c454e02767ed0 : 15893491
PolicyBased: 1a66c3cfc9939001b2243b9fa6894466 : 15893491
/api/v2/info/interface : time_interval=1200
/api/v2/info/user/device/query : time_interval=900

/api/v2/info/interface: last_sent=2024-08-10 15:42:58 data_length=30344
/api/v2/info/user/device/query: last_sent=2024-08-10 15:42:58 data_length=372767 page_device_limit=1000 total_page=1 total_devices=85

diag log kernel-stats
fgtlog: 2
fgtlog 0: total-log=11952081, failed-log=0 log-in-queue=0
fgtlog 1: total-log=10598435, failed-log=0 log-in-queue=0

diag debug app oftpd 8 <wan-ip>

FAZVM64-VIO-CLOUD # 2024-08-10 15:56:24 logs of past 120 sec: 1778
2024-08-10 15:57:24 logs of past 180 sec: 2551

best regards

Martin

[tpatel]

Hello Martin, 

Can you please check on fortianalyzer cloud what the fortigate status shows in global region.
Connection shows allow in cli.