FortiClient events no longer populate in EMS

[FortiNet_Newb]

Since upgrading our EMS server to 7.2.5 and our clients to FC 7.2.5, the clients Web Filter, Video Filter, Vulnerability, and System Events no longer populate in EMS at all.  These events don't update under the Endpoint Views for the clients and therefore the Vulnerability Dashboard does not show any information for detected Vulnerabilities either.  If you check the clients, they are definitely logging these events and, they are just no longer being populated in EMS.  I've checked every setting in EMS and on the Client configurations and I can not find out what is breaking this.  I've confirmed that the necessary ports are still open and that there are no filters in place to prevent them from showing in EMS.  The clients are still successfully updating everything else in EMS just not the event info.

Anyone else come across this and have a fix?

[dingjerry_FTNT]

Hi @FortiNet_Newb ,

Could you please provide a screenshot of the web filter profile you used in the FortiClient in this issue?  

I want to check the Web Filter first for this logging issue.

[FortiNet_Newb]

Here you go:

[dingjerry_FTNT]

Thanks. Could you please turn on those two options:

[FortiNet_Newb]

Sure, I just tried enabled both options waited for the client to sync policies/verified new options were applied to the client.  Still not getting any events in EMS.

[dingjerry_FTNT]

Umm, weird.

What were the versions for EMS and FCT before the upgrade?  And what upgrade paths did you take for EMS and FCT?

[FortiNet_Newb]

EMS was on 7.2.4 and most clients were on FC 7.2.4 with a few others on FC 7.0.11.

Clients were all updated using the official FC 7.2.5 installer package that was automatically downloaded by EMS.  I simply updated the deployment to use the official FC 7.2.5 installer, and all the machines updated accordingly.

[FortiNet_Newb · Accepted solution]

To resolve this issue, I had to have all of my users re-register to EMS by sending them an invitation.  Once the users clicked the register link, event information started populating in EMS again.

The upgrade to 7.2.5 must have broke something.  It's just really odd as everything else was working normally, the clients were all showing as licensed and were still syncing profiles with the EMS server, EMS server was indicating they were managed, EMS was properly displaying and updating device information/status/features, etc..