FortiAnalyzer
FortiAnalyzer can receive logs and Windows host events directly from endpoints connected to EMS, and you can use FortiAnalyzer to analyze the logs and run reports.
asrour
Staff
Staff
Article Id 265485
Description This article describes how to set up FortiAnalyzer to check the validity of licenses for all FortiGate firewalls. and send an email notification when licenses are about to expire.  

With the help of such notifications, it is possible to stay on top of license renewals and avoid license expiry.
Scope FortiAnalyzer v6.X and v7.X.
Solution

Two steps are needed for this action:

 

  1. In the FortiGate, enable warning logs of license expiration:
config alertemail setting
    set FDS-license-expiring-warning enable
    set FDS-license-expiring-days 30
end

 

FortiGate will check the license expiration every midnight (00:00:00).
Warning logs will be generated if the expiration days left are less than or equal to the set value in the command 'FDS-license-expiring-days'. 

 

Sample Logs:

date=2021-04-17 time=00:00:00 eventtime=1618642800235396673 tz="-0700" logid="0100020102" type="event" subtype="system" level="warning" vd="root" logdesc="FortiGuard antispam license expiring" msg="FortiGuard anti-spam license will expire in 27 day(s)"
 
date=2021-04-17 time=00:00:00 eventtime=1618642800235394536 tz="-0700" logid="0100020101" type="event" subtype="system" level="warning" vd="root" logdesc="FortiGuard web filter license expiring" msg="FortiGuard web filtering license will expire in 27 day(s)"
 
date=2021-04-17 time=00:00:00 eventtime=1618642800235383611 tz="-0700" logid="0100020104" type="event" subtype="system" level="warning" vd="root" logdesc="FortiGuard IPS license expiring" msg="FortiGuard Industrial IPS update license will expire in 27 day(s)"
 
date=2021-04-17 time=00:00:00 eventtime=1618642800235372391 tz="-0700" logid="0100020104" type="event" subtype="system" level="warning" vd="root" logdesc="FortiGuard IPS license expiring" msg="FortiGuard IPS update license will expire in 27 day(s)"
 
date=2021-04-17 time=00:00:00 eventtime=1618642800230035225 tz="-0700" logid="0100020103" type="event" subtype="system" level="warning" vd="root" logdesc="FortiGuard antivirus license expiring" msg="FortiGuard AV update license will expire in 27 day(s)"
 
  1. In the FortiAnalyzer, create an event handler for the logids of the logs below:

 

faz_event_handler.png

 


Then, the email notification checkbox should be 
selected.

notification.png