Legacy Fortinet Connector cannot be deleted

[roboftheblues]

Despite the fact that the OMS agent has been removed from the Linux VM, the legacy connector still shows 'Connected' and cannot be deleted. I understand that this is deprecated in August 2024 but we should be able to disconnect and delete it. We have already installed the CEF AMA Connector.

[v-sudkharat]

Hi @roboftheblues, The data connector has their own Connectivity Criteria, and it is in sync with the Log Analytic Workspace. The query will check the expected result in the LAW and based on that the connect status will get displayed.
Ex. If you run below data connector connectivity criteria query into your workspace and if you get result as True, it means your connector will show up as Connected for that time period -

CommonSecurityLog| where DeviceVendor == "Fortinet"| where DeviceProduct startswith "Fortigate" | summarize LastLogReceived = max(TimeGenerated) | project IsConnected = LastLogReceived > ago(7d)

In addition, you cannot delete the data connector once it gets installed into the workspace.
Please let us know if we resolve your issue, so we can close it from GitHub.
Thanks!

[roboftheblues]

That doesn't show which connector it is. We also have the CEF AMA Connector connected to the log forwarder which is collecting logs from the Fortinet Firewall

[v-sudkharat]

Hey @roboftheblues, Could you please share more context about the connector or the expected behavior. As per your issue description it's looks you are having below 2 CEF connector is configured but not getting from where the log's get pull.

Thanks!

[roboftheblues]

We are expecting the CEF AMA connector to collect logs from the log forwarder in accordance with the configured DCR. All tests passed but the connector does not collect the logs. The logs are present on the log forwarder and being updated but not collected.

[v-sudkharat]

Hi @roboftheblues, Thanks for your response, we will check on the issue and will update you.
Thanks!

[v-sudkharat]

That doesn't show which connector it is. We also have the CEF AMA Connector connected to the log forwarder which is collecting logs from the Fortinet Firewall

Hey @roboftheblues, Could you please check the "CollectorHostName" column having data into your workspace, If it contains the data for it then your CEF AMA Connector is configured.
You can run below query: -

CommonSecurityLog
|where DeviceVendor =~ 'Fortinet' 
|where DeviceProduct =~ 'Fortigate'   
|extend sent_by_ama = column_ifexists('CollectorHostName','')
| project sent_by_ama

Select the timestamp as custom to get the result. and let us know the result for it.
Thanks!

[v-sudkharat]

Hi @roboftheblues, waiting for your response on above comment. Thanks!

[roboftheblues]

Hi, Sorry, I’m on holiday, can’t get back to you until the 8th earliest Regards, Rob

…

Sent from my iPhone On 2 Apr 2024, at 09:15, v-sudkharat ***@***.***> wrote:  Hi @roboftheblues<https://github.com/roboftheblues>, waiting for your response on above comment. Thanks! — Reply to this email directly, view it on GitHub<#10166 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/BG6WY56LJLDSYEBLJC6RC7DY3JSIVAVCNFSM6AAAAABE3PCZRCVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDAMZRGM2TONRWHA>. You are receiving this because you were mentioned.Message ID: ***@***.***>

[v-sudkharat]

@roboftheblues, Noted. Please let us know anything need from us. Thanks!

[v-sudkharat]

Hi @roboftheblues, Waiting for your response. Thanks!

[roboftheblues]

Waiting for you to book a slot in my teams ***@***.*** Sent from my iPhone On 9 Apr 2024, at 15:41, v-sudkharat ***@***.***> wrote:  Hi @roboftheblues<https://github.com/roboftheblues>, Waiting for your response. Thanks! — Reply to this email directly, view it on GitHub<#10166 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/BG6WY53C7MIPSUJGJ2OMNT3Y4PVZ5AVCNFSM6AAAAABE3PCZRCVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDANBVGIYDQNRVGY>. You are receiving this because you were mentioned.Message ID: ***@***.***>

[v-sudkharat]

@roboftheblues, Noted.

[roboftheblues]

Sorry, didn't realise my email address came out wrong here!
robwood894@hotmail.com

[roboftheblues]

Please feel free to add a meeting to my calendar for next week. I am on CET

[roboftheblues]

Waiting for a response from you, i need to discuss the issues with the fortinet connectors and the CEF AMA connector

[v-sudkharat]

Hey @roboftheblues, Need some more time to repro this issue :- #10146 in our environment.
And regrading this issue :- #10166, We have shared the query on in this comment (#10166 (comment)) to know which connector has been configured.

Thanks!

[roboftheblues]

CollectorHostName isn't being sent

[v-sudkharat]

@roboftheblues, Noted. Let us check on this and will share update with you. Thanks!