Fortianalyzer v6.0.10 Upgrade Guide
Fortianalyzer v6.0.10 Upgrade Guide
Fortianalyzer v6.0.10 Upgrade Guide
Version 6.0.10
FORTINET DOCUMENT LIBRARY
https://docs.fortinet.com
FORTINET BLOG
https://blog.fortinet.com
NSE INSTITUTE
https://training.fortinet.com
FORTIGUARD CENTER
https://fortiguard.com/
FEEDBACK
Email: [email protected]
Introduction 4
Preparing to Upgrade FortiAnalyzer 5
Downloading files from Customer Service & Support 5
Downloading release notes and firmware images 5
Downloading MIB files for SNMP 6
FortiAnalyzer firmware images 7
FortiAnalyzer VM firmware images 7
Build numbers 7
Reviewing FortiAnalyzer 6.0.10 Release Notes 8
Planning when to upgrade 8
Reviewing status of managed devices 8
CLI example of diagnose log device 9
Reviewing FortiAnalyzer System Settings 10
Backing up configuration files and databases 10
Backing up logs 11
Checking reports 11
Creating a snapshot of VM instances 12
Upgrading FortiAnalyzer 13
Upgrading FortiAnalyzer Firmware 13
Checking FortiAnalyzer log output 14
Checking FortiAnalyzer events 15
Downgrading to previous firmware versions 15
Verifying FortiAnalyzer Upgrade Success 16
Verifying database rebuild success 16
Verifying device and ADOM disk quota 16
Verifying required daemons are running 16
Checking Alert Message Console and notifications 17
Checking managed devices 17
Upgrade Policies for Log Storage 18
Disk space allocation policy 18
Normal ADOM mode 18
Advanced ADOM mode 18
Additional policies 19
Data retention policy 19
Existing ADOMs 19
New ADOMs 19
Supported Models 20
Firmware Upgrade Paths 21
Fortinet Security Fabric 21
Change Log 22
This document describes how to upgrade FortiAnalyzer to 6.0.10. This guide is intended to supplement the
FortiAnalyzer Release Notes, and it includes the following sections:
l Preparing to Upgrade FortiAnalyzer on page 5
l Upgrading FortiAnalyzer on page 13
l Verifying FortiAnalyzer Upgrade Success on page 16
l Upgrade Policies for Log Storage on page 18
l Supported Models on page 20
l Firmware Upgrade Paths on page 21
Firmware best practice: Stay current on patch releases for your current major release. Only
upgrade to a new major release or version when you are looking for specific functionality in the
new major release or version. For more information, see the FortiAnalyzer Release Notes, or
contact Fortinet Customer Service & Support (https://support.fortinet.com/).
Upgrade FortiAnalyzer before upgrading FortiOS, and be sure to maintain release version
compatibility at all times.
We recommend performing the following tasks to prepare for a successful upgrade of a FortiAnalyzer unit. Following is
a summary of the preparation tasks and a link to the details for each task.
1. Download release notes, firmware images, and SNMP MIB files. See Downloading files from Customer Service &
Support on page 5.
2. Review release notes. See Reviewing FortiAnalyzer 6.0.10 Release Notes on page 8.
3. Plan when to perform the upgrade. See Planning when to upgrade on page 8.
4. Review the status of managed devices. See Reviewing status of managed devices on page 8.
5. Review FortiAnalyzer System Settings pane. See Reviewing FortiAnalyzer System Settings on page 10.
6. Back up configuration files and databases. See Backing up configuration files and databases on page 10.
7. Back up logs. See Backing up logs on page 11.
8. Check reports. See Checking reports on page 11
9. Clone VM instances. See Creating a snapshot of VM instances on page 12.
You can download release notes and firmware images from the Fortinet Customer Service & Support portal at
https://support.fortinet.com. If you are using SNMP to monitor equipment, you can also download MIB files from the
Fortinet Customer Service & Support portal.
This section contains the following topics:
l Downloading release notes and firmware images on page 5
l Downloading MIB files for SNMP on page 6
l FortiAnalyzer firmware images on page 7
l FortiAnalyzer VM firmware images on page 7
l Build numbers on page 7
Firmware images are located on the Fortinet Customer Service & Support portal, and they are organized by firmware
version, major release, and patch release.
For information about the naming convention of firmware images and VM firmware images, see FortiAnalyzer firmware
images on page 7, FortiAnalyzer VM firmware images on page 7, and Build numbers on page 7.
If you are not using SNMP to monitor equipment, you can skip this procedure.
If you are using SNMP to monitor equipment, download the following MIB files from the Fortinet Customer Service &
Support portal:
l FORTINET-FORTIMANAGER-FORTIANALYZER-MIB.mib, which is used with both FortiManager and
FortiAnalyzer
l Fortinet Core MIB file, which is used with all Fortinet products
The firmware images in the folders follow a specific naming convention, and each firmware image is specific to the
device model or VM.
For example, the FAZ_1000D-v6-build0457-FORTINET.out image found in the /FortiAnalyzer/v6.00/6.0/6.0.0/
folder is specific to the FortiAnalyzer 1000D device model.
FortiAnalyzer 5.6.0 and later uses a different network interface mapping for ESX VM
networks. After upgrading to FortiAnalyzer 6.0.10, edit the ESX VM network mapping to
preserve network connectivity.
l port1 — Network Adapter 1
New FortiAnalyzer 6.0.10 VM installations use the correct mapping with ESX 5.5 and later.
Build numbers
Firmware images are generally documented as build numbers. New models may be released from a branch of the
regular firmware release. As such, the build number found in the System Settings > Dashboard > System Information
widget and the output from the get system status CLI command displays this four-digit build number as the build
number.
To confirm that you are running the proper build, the output from the get system status CLI command has a
Branch Point field that displays the regular build number.
Ensure that FortiAnalyzer 6.0.10 can run on your FortiAnalyzer model. See Supported Models on page 20.
After you download the release notes for FortiAnalyzer 6.0.10, review the special notices, upgrade information, product
integration and support, resolved issues, and known issues.
Plan a maintenance window to complete the firmware upgrade. If possible, you may want to set up a test environment
to ensure that the upgrade does not negatively impact your network or managed devices.
Before starting an upgrade, use the Device Manager pane to review the status of all logging devices to ensure 0 devices
have a status of Log Status Down.
Either correct devices with a Log Status Down status or make note of them prior to starting the upgrade.
Following is an example of the Device Manager pane with 7 devices that have a status of Log Status Down.
You can use the following CLI commands to review the status of managed devices. Use this command to check that
device and ADOM disk quota are correct before and after the upgrade.
l diagnose log device
This section contains the following topics:
l CLI example of diagnose log device on page 9
Run this command before the upgrade and keep the output. After the upgrade, run this command again and check that
device and ADOM disk quota are correct.
Following is an example of the CLI output for the diagnose log device command:
FAZ1000E # diagnose log device
Device Name Device ID Used Space(logs/quarantine/content/IPS) Allocated Space Used%
CSF-81E-HA FGHA0815848309_CID 163.4MB( 163.4MB/ 0.0KB/ 0.0KB/ 0.0KB) unlimited n/a
|- HA cluster member: FG81EP4Q16000393
|- HA cluster member: FG81EP4Q16001954
FG101E-L2 FG101E4Q17001425 0.0KB( 0.0KB/ 0.0KB/ 0.0KB/ 0.0KB) unlimited n/a
FG101E-L3 FG101E4Q17001278 0.0KB( 0.0KB/ 0.0KB/ 0.0KB/ 0.0KB) unlimited n/a
FG280DPOE-L3 FG280P4614800182 18.0MB( 18.0MB/ 0.0KB/ 0.0KB/ 0.0KB) unlimited n/a
FGT100D-HA FGHA000879790946_CID 0.0KB( 0.0KB/ 0.0KB/ 0.0KB/ 0.0KB) unlimited n/a
|- HA cluster member: FG100D3G13802934
|- HA cluster member: FG100D3G14811667
FGT200DPOE-L1-root FGP2046148316 10.6MB( 10.6MB/ 0.0KB/ 0.0KB/ 0.0KB) unlimited n/a
FGVM-076-L2 FGVM020000069046 4.7MB( 4.7MB/ 0.0KB/ 0.0KB/ 0.0KB) unlimited n/a
vm1 FGVM021111111111 0.0KB( 0.0KB/ 0.0KB/ 0.0KB/ 0.0KB) unlimited n/a
Total: 8 log devices, used=196.7MB quota=unlimited
It is recommended that you create a system backup file and save this configuration to your local computer. The device
configuration file is saved with a .dat extension.
It is also recommended that you verify the integrity of your backup file.
When the database is larger than 2.8 GB, back up the configuration file to an FTP, SFTP, or
SCP server using the following CLI command:
execute backup all-settings {ftp | sftp} <ip> <path/filename of server>
<username on server> <password> <crptpasswd>
execute backup all-settings scp <ip> <path/filename of server> <SSH
certificate> <crptpasswd>
For more information, see the FortiAnalyzer CLI Reference.
If you encrypt the backup file, you must use the same password to restore this backup file.
Backing up logs
Checking reports
Wait until all the running reports are completed, and ensure that no reports are scheduled to run during the upgrade.
You can use the following CLI commands to check for running and pending reports:
FAZ1000D # dia report status running
FAZ1000D # dia report status pending
In VM environments, it is recommended to stop the VM instance and take a snapshot or clone of the VM instance before
the upgrade. If there are issues with the upgrade, you can revert to the VM snapshot or clone.
Avoid taking snapshots when applications in the virtual machine are communicating with
other computers.
If you are upgrading a FortiAnalyzer VM, make sure your VM partition has more than 512MB (1024MB or more
recommended) and your VM server is up to date.
You can upgrade FortiAnalyzer 5.6.0 or later to FortiAnalyzer 6.0.10. If you are upgrading from versions earlier than
5.6.0, you must upgrade to FortiAnalyzer 5.6 first, and then to 6.0.10. We recommend that you upgrade to the latest
version of FortiAnalyzer 5.6.
For other upgrade paths, see Firmware Upgrade Paths on page 21.
This section contains the following topics:
l Upgrading FortiAnalyzer Firmware on page 13
l Checking FortiAnalyzer log output on page 14
l Checking FortiAnalyzer events on page 15
l Downgrading to previous firmware versions on page 15
Upgrading the device firmware can trigger an SQL database rebuild. New logs are not
available until the rebuild is complete. The time required to rebuild the database depends on
the size of the database. You can use the diagnose sql status rebuild-db
command to display the SQL log database rebuild status.
The following features are available until the SQL database rebuild is complete: FortiView ,
Log View, Event Management, and Reports.
To upgrade firmware for a cluster, Fortinet recommends upgrading the HA secondary units
first, followed by the HA primary unit last. To avoid losing log information, wait until each
FAZ upgrade has finished before proceeding to the next.
To upgrade firmware:
When the upgrade completes, you might have to refresh your web browser to see the
login window.
6. If the database needs rebuilding, you can monitor the rebuild status by double-clicking the Rebuilding DB status in
the toolbar.
The rebuild process includes two steps. When it’s done, you see the Rebuilding log database was completed
message.
7. Review the System Settings > Event Log for any additional errors. See Checking FortiAnalyzer events on page 15.
Optionally, you can upgrade firmware stored on an FTP or TFTP server using the following
CLI command:
execute restore image {ftp | tftp} <file path to server> <IP of server>
<username on server> <password>
For more information, see the FortiAnalyzer CLI Reference.
While upgrading a FortiAnalyzer unit, use the console to check the log output in real-time. Check for any errors or
warnings.
Following is a sample console output of an upgrade:
Serial number:FAZ-VM0000000001
Upgrading geography IP data...Done.
Initialize file systems...
Old version: v5.4.3-build1187 branchpt1187 170518 (GA)
New version: v5.4.4-build1220 branchpt1220 170928 (GA)
Global DB running version is 429, built-in DB schema version is 429
Upgrading report config from version:5. patch:3, branch point:1187
Exporting existing config... (step 1/4)
export (13/13) adoms. took 14 sec.
Initializing default config... (step 2/4)
init (13/13) adoms. took 12 sec.
Upgrading existing config... (step 3/4)
Upgrading V5.4.2->V5.4.3...
process (13/13) adoms. took 19 sec.
Importing upgraded config... (step 4/4)
import (13/13) adoms. took 10 sec.
Upgrade report config completed. took 55 sec.
After upgrading, it is recommended to check all messages logged to the FortiAnalyzer Event Log. If you find any errors,
you can fix the errors before continuing.
Following is an example of messages in the FortiAnalyzer Event Log:
FortiAnalyzer does not provide a full downgrade path. You can downgrade to a previous firmware release using the GUI
or CLI, but this causes configuration loss. A system reset is required after the firmware downgrade. To reset the system,
use the following CLI commands via a console port connection:
execute reset {all-settings | all-except-ip}
execute format {disk | disk-ext4 | disk-ext3}
Once the upgrade is complete, check the FortiAnalyzer unit to ensure that the upgrade was successful. This section
describes items you should check.
By default, the SQL database is disabled for the Collector mode in 5.4 and later to optimize
performance. For a Collector with the SQL database enabled, the SQL database is disabled
after upgrade. You can re-enable the SQL storage settings to view logs and analytics with the
following CLI commands:
config system sql
set status local
end
Upgrade automatically triggers an SQL rebuild post upgrade to 6.0, which must complete for FortiAnalyzer to function
normally. Verify the database rebuild status using the following CLI command:
diagnose sql status rebuild-db
Run the diagnose log device CLI command after the upgrade and compare it to the output before the upgrade.
Check that the device and ADOM disk quota allocations are correct. See CLI example of diagnose log device on page 9.
Use the following CLI commands to check that the following daemons are running:
l diagnose test application fortilogd 1
l diagnose test application sqllogd 2
l diagnose test application oftpd 2
After the FortiAnalyzer upgrade completes, check the Alert Message Console and list of notifications for any messages
that might indicate problems with the upgrade.
l In System Settings > Dashboard, check the Alert Message Console widget.
l Click the Notification icon and review any notifications.
For information on accessing system settings, see Reviewing FortiAnalyzer System Settings on page 10.
After the FortiAnalyzer upgrade completes, check the managed devices in the GUI.
1. Refresh the browser and log back into the device GUI.
2. Go to Device Manager, and ensure that all formerly added devices are still listed.
3. In Device Manager, select each ADOM and ensure that managed devices reflect the appropriate connectivity
state.
Following is an example of the quick status bar in Device Manager where you can check the connectivity status of
managed devices. It might take some time for FortiAnalyzer to establish connectivity after the upgrade.
4. Launch other functional modules and make sure they work properly.
This section describes how the upgrade from FortiAnalyzer 5.2.x to 5.4.0 and later affects the disk allocation policy and
the data retention policy, and it contains the following topics:
l Disk space allocation policy on page 18
l Data retention policy on page 19
This section applies only when upgrading FortiAnalyzer 5.2.x to 5.4.0 and later because log
storage policies changed in FortiAnalyzer 5.4.0.
For FortiAnalyzer 5.2 and earlier, disk space is allocated per device. Starting in FortiAnalyzer 5.4, disk space can be
allocated per ADOM. Following is the policy governing disk space allocation when FortiAnalyzer is upgraded from 5.2 to
5.4.0 and later.
For FortiAnalyzer working in the Normal ADOM mode, after upgrading to 5.4.0 and later, the ADOM for each managed
device (with or without VDOMs) is allocated the disk space of the device before upgrade plus 10%.
For example, a FortiGate device allotted 30GB in 5.2 gets 33GB (30GB + 10%) to the ADOM of this FortiGate device
after the upgrade to FortiAnalyzer 5.4.0 and later.
For FortiAnalyzer working in the Advanced ADOM mode, after upgrading to 5.4.0 and later, the disk space of the device
is split among the VDOMs of different ADOMs proportional to the log distribution across the VDOMs. Each ADOM also
gets 10% extra.
For example, the disk quota for Device-A is 10GB in 5.2. Device-A consists of three VDOMs: root VDOM (the
management VDOM), VDOM1, and VDOM2, which are assigned to ADOM root, ADOM1, and ADOM2 respectively.
During the upgrade, FortiAnalyzer calculates that 10% of Device-A log files are from root VDOM, 30% from VDOM1,
and 60% from VDOM2. Accordingly, FortiAnalyzer assigns 1.1GB (1GB + 10%) to ADOM root, 3.3GB (3GB + 10%) to
ADOM1, and 6.6GB (6GB+ 10%) to ADOM2.
Additional policies
When the content files of the device, including DLP (data leak prevention) files, antivirus quarantine files, and IPS
(intrusion prevention system) packet captures, use more than 40% of its disk quota, FortiAnalyzer adds extra space to
the device.
ADOM disk quota is recommended to be at least 1GB in 5.4. If the disk quota of a device is less than 1GB before
upgrading to 5.4.x, the ADOM quota for the device is adjusted to 1GB after upgrading to 5.4.x.
This adjustment might cause the total allocated disk space to exceed the actual device disk
space. Verify using the diagnose log device command. If necessary, you can adjust
the disk space back to less than 1GB.
This section describes how the upgrade from FortiAnalyzer 5.2.x to 5.4.0 and later affects the data retention policy for
existing and new ADOMs.
Existing ADOMs
For existing ADOMs, both Archive logs and Analytics logs are kept for 365 days + the age in days of the oldest
Archive/Analytics logs respectively. For example, the oldest Archive logs of a device were generated on February 1,
2016, and the oldest Analytics logs were generated on March 1, 2016. Today is April 7. So the oldest Archive logs are 67
days old, and the oldest Analytics logs are 38 days old. After upgrade to 5.4.0 and later, FortiAnalyzer will keep the
Archive logs for 365+67=432 days, and keep the Analytics logs for 365+38=403 days.
New ADOMs
For newly created ADOMs, Archive logs are kept for 365 days, and Analytics logs are kept for 60 days.
FortiAnalyzer FortiAnalyzer VM
FAZ-200D FAZ-VM64
FAZ-200F FAZ-VM64-Ali
FAZ-300D FAZ-VM64-AWS
FAZ-300F FAZ-VM64-AWS-OnDemand
FAZ-400E FAZ-VM64-Azure
FAZ-800F FAZ-VM64-GCP
FAZ-1000D FAZ-VM64-HV
FAZ-1000E FAZ-VM64-KVM
FAZ-2000E FAZ-VM64-OPC
FAZ-3000D FAZ-VM64-XEN (Citrix XenServer and Open Source Xen)
FAZ-3000E
FAZ-3000F
FAZ-3500E
FAZ-3500F
FAZ-3700F
FAZ-3900E
5.4.0 or later Latest 5.6 version, then to latest 6.0 version. Yes
5.2.0 or later Latest 5.4 version, then to the latest 5.6 version, then to Yes
latest 6.0 version.
5.0.6 or later Latest 5.2 version, then to the latest 5.4 version, then to Yes for 5.0.6, no for the rest
the latest 5.6 version, then to latest 6.0.0 version.
FortiGate units with logdisk buffer log data while FortiAnalyzer units are rebooting. In most
cases, the buffer is enough to cover the time needed for FortiAnalyzer to reboot. However,
Fortinet still recommends configuring multiple log destinations to ensure no logs are lost.
If you are upgrading the firmware for a FortiAnalyzer unit that is part of a FortiOS Security Fabric, be aware of how the
FortiOS Security Fabric upgrade affects the FortiAnalyzer upgrade. You must upgrade the products in the Security
Fabric in a specific order. For details, see the FortiOS Fortinet Security Fabric Upgrade Guide in the Document Library
at https://docs.fortinet.com/product/fortigate/6.0.