What's the connection between Forticron and factory reset?

[simonorch]

What is the connection between a factory reset and forticron?

We had a 60D running 5.2.8 suddenly go offline and in FAZ the last system log events were:

User reset to the factory settings from forticron

User rebooted the device from forticron. The reason is 'factory reset'

what i know is that it wasn't done via FMG and the box wasn't rebooted so it can't have been the reset button.'

Any ideas

Simon

[simonorch]

I experienced this same behaviour with another customer, also a 60D on 5.2.X and also a FMG managed box.

I know for sure they only rebooted the box.

[AscyaB]

Hi Simon

Did you manage to identify how this happened?

I know this is years later but i have experienced this recently on a 60E. 6.4.5

Have checked all the logs on fortimanager and forticloud and i only see that forticron has initiated the factory reset.

The firewall was going in and out of conserve mode, then just seemed to factory reset itself.

[nateGop]

Just had the same thing last week on a 60D and again this morning. I have a 60F that I am going to get the config file converted for and decommission the 60D. Did you figure out the issue or run into it again?

[sferoz]

Good Day,

Thank you for using the Community Forum. 

Forticron is the process responsible for scheduling the tasks.

If forticron is causing high CPU /memory we have to check further on the FOS firmware version,memory/CPU logs.

Kindly update the below logs along with the current FOS version.

Below logs are useful for further review:

#diagnose sys top-mem

#get system status
#diag sys top all-summary
#get system performance status
#diag sys top 1 40 (Run for 30 Sec and CTRL C to stop)
#diag sys top-summary (Run for 30 Sec and CTRL C to stop)
#diagnose autoupdate versions
#diagnose autoupdate versions | grep -A2 "IPS"
#diagnose hardware sys shm
#diag hard sys mem
#diag sys mpstat
# diagnose sys top-all
#diag hard sys slab
#diag sys session stats
#diag sys session full-stat
#di de crashlog read | grep 2022
#diag firewall statistic show
#diag sys top-fd
#diag sys top-mem
#diag sys top-sockmem
#diag sys top-all
#diagnose hardware sysinfo conserve
#diag debug report
#diag deb config-error-log read | grep 2022

 
Thanks,
Feroz

[AscyaB]

I opened a ticket with Fortinet support. Supplied the logs from Fortimanager and Forticloud. There is no where to show the factory reset was initiated by a user.

Fortinet has issued an RMA to replace the firewall as there was no conclusion why it reset.

On version 6.4.5, we will look to upgrade the firmwares on all our firewalls soon.