FortiManager
FortiManager supports network operations use cases for centralized management, best practices compliance, and workflow automation to provide better protection against breaches.
Stelios_FTNT
Staff
Staff
Article Id 195016

Description

The FortiManager Database can periodically become corrupt or inconsistent for various normal or unexpected reasons.  Sometimes these corruptions go unnoticed for many days until identified by an administrator.

To avoid a large amount of lost work, changes and time, an automatic background verification has been added, using existing debug commands on the database, as of v5.0.8 and v5.2.6.  This automatic background verification is run just before the configured scheduled backup of the FortiManager is performed.  "Possible database integrity problem detected during scheduled verification. Please check manually" before running a scheduled backup.

The following CLI commands have been used to verify the database integrity:
diag dvm check-integrity
diag cdb check policy-assignment
diag cdb check objcfg-integrity
diag pm2 check-integrity all

As of 5.2.9/5.4.2, the following new integrity check commands have been added in this automated verification:
diag cdb check reference-integrity
diag cdb check adom-integrity
diag cdb check policy-packages

These commands do not automatically make any corrections on the database.  This will be left up to the operator to run the commands again manually to confirm that there is a problem.  The automatic process that was added will generate an Event Log in the Alert Message Console and to the Local Event Log:

Upon successful verification: "Scheduled database integrity verifications successful"

Upon unsuccessful verification: "Possible database integrity problem detected during scheduled verification. Please check manually"


Solution

Should this message appear in the Alert Message Console of the FortiManager following a scheduled backup of the configuration, the administrator should manually run the following commands to confirm and correct any potential corruptions of the database:
diag dvm check-integrity
diag cdb check policy-assignment
diag cdb check objcfg-integrity
diag pm2 check-integrity all
diag cdb check reference-integrity
diag cdb check adom-integrity
diag cdb check policy-packages