Re: FortiSIEM Report with multiple Data Source

idabouzi · 11-24-2025

Description This article describes how to delete data from the Clickhouse database. Scope FortiSIEM, Clickhouse. Solution The steps below are to be followed in order to delete data quickly from the Clickhouse database, usually to release disk space. ...

idabouzi · 10-24-2025

Description This article describes how to release disk space from the root partition that is caused by /fsmopt.tar.gz. Scope FortiSIEM. Solution The fsmopt.tar.gz files found in the root (/) directory are backup archives of the /opt/fsm directory cre...

idabouzi · 10-24-2025

Description This article describes how to create a multi-tenant collector. Scope FortiSIEM. Solution Multi-tenant Collectors handle devices and logs from multiple Organizations. It must be defined under the Super/Local Organization as follows: Switch...

idabouzi · 09-29-2025

Description This article describes how to fix the 'Device merged by IP' error. Scope FortiSIEM. Solution This error will occur when failing to add new devices, usually with an error (skipped) from the GUI: Logs show the message below. Example: 2025-0...

idabouzi · 08-19-2025

Description This article describes how to recover the etcd service after an upgrade failure Scope FortiSIEM v7.3.0. Solution 'etcd service' was first introduced in v7.3.0: What's New in 7.3.0https://etcd.io/docs/v3.3/faq/ The upgrade can fail because...

idabouzi · 06-27-2024

Hi Amir, You can create the reports that you want and then add them to a Bundle report;You can find more details about how to create Bundle reports in the following Kb:https://community.fortinet.com/t5/FortiSIEM/Technical-Tip-How-to-create-amp-schedu...

User Statistics

User Activity

Technical Tip: How to delete data from Clickhouse database

Technical Tip: How to fix root disk space full due to /fsmopt.tar.gz

Technical Tip: How to create a multi-tenant Collector

Technical Tip: How to fix PH_AUDIT_DEVICE_MERGED_BY_IP_WITH_DIFF_NAME

Technical Tip: How to fix upgrade failure due to an etcd service issue