11005901

11005901

Meaning
Either: the FortiGuard Antivirus, FortiGuard FortiWeb Security Service, or FortiGuard IP Reputation Intelligence Service (IRIS) license could not be authenticated the FortiGuard services were up-to-date as of the time when FortiWeb polled FortiGuard for updates FortiWeb could not connect to the FDN update servers, or the connection was interrupted, and therefore could not update its packages for FortiGuard services a FortiGuard service update installation failed a FortiGuard service update succeeded License authentication determined that the FortiWeb-VM license uploaded by an administrator is either valid or invalid.

Meaning

Either:

the FortiGuard Antivirus, FortiGuard FortiWeb Security Service, or FortiGuard IP Reputation Intelligence Service (IRIS) license could not be authenticated
the FortiGuard services were up-to-date as of the time when FortiWeb polled FortiGuard for updates
FortiWeb could not connect to the FDN update servers, or the connection was interrupted, and therefore could not update its packages for FortiGuard services
a FortiGuard service update installation failed
a FortiGuard service update succeeded
License authentication determined that the FortiWeb-VM license uploaded by an administrator is either valid or invalid.

Solution

Solution
If a FortiGuard license could not be authenticated: Check with Fortinet Customer Service & Support (https://support.fortinet.com/) to make sure that you have purchased a license for this FortiWeb. If you have an HA pair, you should have one license for each appliance in the pair. Verify that the license is not currently expired, or not yet in effect. Verify that FortiWeb can connect to the Internet to validate its license. To do this, it will require a valid route, DNS settings, and possibly also time settings. If connectivity is unreliable, the initial license request may fail. In this case, you can either wait 30 minutes for the appliance to request authorization again, or use the CLI command `execute update-now` to force an immediate license authentication query. If FortiWeb could not connect to the FDN or package retrieval failed, verify that FortiWeb has reliable Internet connectivity. If the license is invalid: Check with Fortinet Customer Service & Support (https://support.fortinet.com/) to make sure that you have purchased a license for this FortiWeb. If you have an HA pair, you should have one license for each appliance in the pair. If you are using a trial license, verify that the trial period has not expired. If you are using a purchased license, verify that you have uploaded the license file to FortiWeb-VM. Verify that the license has not been already used by another. (If you upload the license and it is currently associated with a different management IP, the web UI will display an error message: `Duplicate license detected.`) Verify that the number of allocated vCPUs does not exceed the limit of the license. Verify that FortiWeb can connect to the Internet to validate its license. To do this, it will require a valid route, DNS settings, and possibly also time settings. If connectivity is unreliable, the initial license request may fail. In this case, you can either wait 30 minutes for the appliance to request authorization again, or use the CLI command `execute update-now` to force an immediate license authentication query.

If a FortiGuard license could not be authenticated:

Check with Fortinet Customer Service & Support (https://support.fortinet.com/) to make sure that you have purchased a license for this FortiWeb. If you have an HA pair, you should have one license for each appliance in the pair.

Verify that the license is not currently expired, or not yet in effect.

Verify that FortiWeb can connect to the Internet to validate its license. To do this, it will require a valid route, DNS settings, and possibly also time settings. If connectivity is unreliable, the initial license request may fail. In this case, you can either wait 30 minutes for the appliance to request authorization again, or use the CLI command execute update-now to force an immediate license authentication query.

If FortiWeb could not connect to the FDN or package retrieval failed, verify that FortiWeb has reliable Internet connectivity.

If the license is invalid:

If you are using a purchased license, verify that you have uploaded the license file to FortiWeb-VM.

Verify that the license has not been already used by another. (If you upload the license and it is currently associated with a different management IP, the web UI will display an error message: Duplicate license detected.)

Verify that the number of allocated vCPUs does not exceed the limit of the license.

Field name	Description
ID (`log_id`)	11005901 See Log ID numbers.
Sub Type (`subtype`)	`system` See Subtypes.
Level (`pri`)	`error` (for unauthorized licenses, update failures, or connectivity errors) `information` (for up-to-date results from the FortiGuard poll) `critical` (for invalid license) See Priority level.
Message (`msg`)	Fortiweb {ip intelligence signature \| virus engine \| virus extend signature \| virus signature \| waf signature} is unauthorized
	Fortiweb {ip intelligence signature \| virus engine \| virus extend signature \| virus signature \| waf signature} is already up-to-date
	update failed, failed to connect to fds server!
	update failed, couldn't receive a update package!
	Fortiweb {ip intelligence signature \| virus engine \| virus extend signature \| virus signature \| waf signature} update failed
	Fortiweb {ip intelligence signature \| virus engine \| virus extend signature \| virus signature \| waf signature} update succeeded
	License status changed to {VALID \| INVALID}

Examples
date=2014-04-10 time=17:00:02 log_id=11005901 msg_id=000000195866 device_id=FV-1KD3A13800012 vd="root" timezone="(GMT+8:00)Beijing,ChongQing,HongKong,Urumgi" type=event subtype="system" pri=critical trigger_policy="" user=daemon ui=daemon action=update status=failed msg="Fortiweb virus engine is unauthorized"
date=2014-04-10 time=17:00:02 log_id=11005901 msg_id=000000123728 device_id=FV-1KD3A13800012 vd="root" timezone="(GMT+8:00)Beijing,ChongQing,HongKong,Urumgi" type=event subtype="system" pri=error trigger_policy="" user=daemon ui=daemon action=update status=failed msg="Fortiweb virus extend signature is unauthorized"
date=2014-04-10 time=17:00:02 log_id=11005901 msg_id=000000123727 device_id=FV-1KD3A13800012 vd="root" timezone="(GMT+8:00)Beijing,ChongQing,HongKong,Urumgi" type=event subtype="system" pri=error trigger_policy="" user=daemon ui=daemon action=update status=failed msg="Fortiweb virus signature is unauthorized"
date=2014-04-10 time=17:00:02 log_id=11005901 msg_id=000000146653 device_id=FV-1KD3A13800012 vd="root" timezone="(GMT+8:00)Beijing,ChongQing,HongKong,Urumgi" type=event subtype="system" pri=information trigger_policy="" user=daemon ui=daemon action=update status=failed msg="Fortiweb waf signature is already up-to-date"
Fortiweb waf signature is unauthorized date=2014-04-10 time=16:00:02 log_id=11005901 msg_id=000000734617 device_id=FV-1KD3A13800027 vd="root" timezone="(GMT-8:00)Pacific Time(US&Canada)" type=event subtype="system" pri=critical trigger_policy="" user=daemon ui=daemon action=update status=failed msg="Fortiweb waf signature is unauthorized"
date=2014-04-10 time=16:00:02 log_id=11005901 msg_id=000000734621 device_id=FV-1KD3A13800027 vd="root" timezone="(GMT-8:00)Pacific Time(US&Canada)" type=event subtype="system" pri=critical trigger_policy="" user=daemon ui=daemon action=update status=failed msg="Fortiweb ip intelligence signature is unauthorized"
date=2014-04-10 time=17:00:02 log_id=11005901 msg_id=000000189416 device_id=FV-1KD3A13800012 vd="root" timezone="(GMT+8:00)Beijing,ChongQing,HongKong,Urumgi" type=event subtype="system" pri=information trigger_policy="" user=daemon ui=daemon action=update status=failed msg="Fortiweb ip reputation signature is already up-to-date"
date=2014-04-10 time=17:00:02 log_id=11005901 msg_id=000000158889 device_id=FV-1KD3A13800012 vd="root" timezone="(GMT+8:00)Beijing,ChongQing,HongKong,Urumgi" type=event subtype="system" pri=error trigger_policy="" user=daemon ui=daemon action=update status=failed msg="update failed failed to connect fds server!"
date=2014-04-10 time=17:00:02 log_id=11005901 msg_id=000000070564 device_id=FV-1KD3A13800012 vd="root" timezone="(GMT+8:00)Beijing,ChongQing,HongKong,Urumgi" type=event subtype="system" pri=error trigger_policy="" user=daemon ui=daemon action=update status=failed msg="Fortiweb virus extend signature update failed"
date=2014-04-10 time=17:00:02 log_id=11005901 msg_id=000000068286 device_id=FV-1KD3A13800012 vd="root" timezone="(GMT+8:00)Beijing,ChongQing,HongKong,Urumgi" type=event subtype="system" pri=information trigger_policy="" user=daemon ui=daemon action=update status=failed msg="Fortiweb virus engine update succeeded"
date=2014-04-10 time=09:36:15 log_id=11005901 msg_id=000000022248 device_id=FVVM00UNLICENSED vd="root" timezone="(GMT-8:00)Pacific Time(US&Canada)" type=event subtype="system" pri=critical trigger_policy="" user=daemon ui=daemon action=update status=failed msg="License status changed to VALID"
date=2014-04-10 time=09:36:15 log_id=11005901 msg_id=000000104120 device_id=FVVM00UNLICENSED vd="root" timezone="(GMT-8:00)Pacific Time(US&Canada)" type=event subtype="system" pri=critical trigger_policy="" user=daemon ui=daemon action=update status=failed msg="License status changed to INVALID"

11005901

Meaning
Either: the FortiGuard Antivirus, FortiGuard FortiWeb Security Service, or FortiGuard IP Reputation Intelligence Service (IRIS) license could not be authenticated the FortiGuard services were up-to-date as of the time when FortiWeb polled FortiGuard for updates FortiWeb could not connect to the FDN update servers, or the connection was interrupted, and therefore could not update its packages for FortiGuard services a FortiGuard service update installation failed a FortiGuard service update succeeded License authentication determined that the FortiWeb-VM license uploaded by an administrator is either valid or invalid.

Meaning

Either:

the FortiGuard Antivirus, FortiGuard FortiWeb Security Service, or FortiGuard IP Reputation Intelligence Service (IRIS) license could not be authenticated
the FortiGuard services were up-to-date as of the time when FortiWeb polled FortiGuard for updates
FortiWeb could not connect to the FDN update servers, or the connection was interrupted, and therefore could not update its packages for FortiGuard services
a FortiGuard service update installation failed
a FortiGuard service update succeeded
License authentication determined that the FortiWeb-VM license uploaded by an administrator is either valid or invalid.

Solution
If a FortiGuard license could not be authenticated: Check with Fortinet Customer Service & Support (https://support.fortinet.com/) to make sure that you have purchased a license for this FortiWeb. If you have an HA pair, you should have one license for each appliance in the pair. Verify that the license is not currently expired, or not yet in effect. Verify that FortiWeb can connect to the Internet to validate its license. To do this, it will require a valid route, DNS settings, and possibly also time settings. If connectivity is unreliable, the initial license request may fail. In this case, you can either wait 30 minutes for the appliance to request authorization again, or use the CLI command `execute update-now` to force an immediate license authentication query. If FortiWeb could not connect to the FDN or package retrieval failed, verify that FortiWeb has reliable Internet connectivity. If the license is invalid: Check with Fortinet Customer Service & Support (https://support.fortinet.com/) to make sure that you have purchased a license for this FortiWeb. If you have an HA pair, you should have one license for each appliance in the pair. If you are using a trial license, verify that the trial period has not expired. If you are using a purchased license, verify that you have uploaded the license file to FortiWeb-VM. Verify that the license has not been already used by another. (If you upload the license and it is currently associated with a different management IP, the web UI will display an error message: `Duplicate license detected.`) Verify that the number of allocated vCPUs does not exceed the limit of the license. Verify that FortiWeb can connect to the Internet to validate its license. To do this, it will require a valid route, DNS settings, and possibly also time settings. If connectivity is unreliable, the initial license request may fail. In this case, you can either wait 30 minutes for the appliance to request authorization again, or use the CLI command `execute update-now` to force an immediate license authentication query.

Solution

If a FortiGuard license could not be authenticated:

Verify that the license is not currently expired, or not yet in effect.

If FortiWeb could not connect to the FDN or package retrieval failed, verify that FortiWeb has reliable Internet connectivity.

If the license is invalid:

If you are using a purchased license, verify that you have uploaded the license file to FortiWeb-VM.

Verify that the number of allocated vCPUs does not exceed the limit of the license.

Field name	Description
ID (`log_id`)	11005901 See Log ID numbers.
Sub Type (`subtype`)	`system` See Subtypes.
Level (`pri`)	`error` (for unauthorized licenses, update failures, or connectivity errors) `information` (for up-to-date results from the FortiGuard poll) `critical` (for invalid license) See Priority level.
Message (`msg`)	Fortiweb {ip intelligence signature \| virus engine \| virus extend signature \| virus signature \| waf signature} is unauthorized
Fortiweb {ip intelligence signature \| virus engine \| virus extend signature \| virus signature \| waf signature} is already up-to-date
update failed, failed to connect to fds server!
update failed, couldn't receive a update package!
Fortiweb {ip intelligence signature \| virus engine \| virus extend signature \| virus signature \| waf signature} update failed
Fortiweb {ip intelligence signature \| virus engine \| virus extend signature \| virus signature \| waf signature} update succeeded
License status changed to {VALID \| INVALID}

Field name

Description

(log_id)

11005901

See Log ID numbers.

Sub Type

(subtype)

system

See Subtypes.

Level

(pri)

error (for unauthorized licenses, update failures, or connectivity errors)

information (for up-to-date results from the FortiGuard poll)

critical (for invalid license)

See Priority level.

Message

(msg)

Fortiweb {ip intelligence signature | virus engine | virus extend signature | virus signature | waf signature} is unauthorized

Fortiweb {ip intelligence signature | virus engine | virus extend signature | virus signature | waf signature} is already up-to-date

update failed, failed to connect to fds server!

update failed, couldn't receive a update package!

Fortiweb {ip intelligence signature | virus engine | virus extend signature | virus signature | waf signature} update failed

Fortiweb {ip intelligence signature | virus engine | virus extend signature | virus signature | waf signature} update succeeded

License status changed to {VALID | INVALID}

Examples

date=2014-04-10 time=17:00:02 log_id=11005901 msg_id=000000195866 device_id=FV-1KD3A13800012 vd="root" timezone="(GMT+8:00)Beijing,ChongQing,HongKong,Urumgi" type=event subtype="system" pri=critical trigger_policy="" user=daemon ui=daemon action=update status=failed msg="Fortiweb virus engine is unauthorized"

date=2014-04-10 time=17:00:02 log_id=11005901 msg_id=000000123728 device_id=FV-1KD3A13800012 vd="root" timezone="(GMT+8:00)Beijing,ChongQing,HongKong,Urumgi" type=event subtype="system" pri=error trigger_policy="" user=daemon ui=daemon action=update status=failed msg="Fortiweb virus extend signature is unauthorized"

date=2014-04-10 time=17:00:02 log_id=11005901 msg_id=000000123727 device_id=FV-1KD3A13800012 vd="root" timezone="(GMT+8:00)Beijing,ChongQing,HongKong,Urumgi" type=event subtype="system" pri=error trigger_policy="" user=daemon ui=daemon action=update status=failed msg="Fortiweb virus signature is unauthorized"

date=2014-04-10 time=17:00:02 log_id=11005901 msg_id=000000146653 device_id=FV-1KD3A13800012 vd="root" timezone="(GMT+8:00)Beijing,ChongQing,HongKong,Urumgi" type=event subtype="system" pri=information trigger_policy="" user=daemon ui=daemon action=update status=failed msg="Fortiweb waf signature is already up-to-date"

Fortiweb waf signature is unauthorized

date=2014-04-10 time=16:00:02 log_id=11005901 msg_id=000000734617 device_id=FV-1KD3A13800027 vd="root" timezone="(GMT-8:00)Pacific Time(US&Canada)" type=event subtype="system" pri=critical trigger_policy="" user=daemon ui=daemon action=update status=failed msg="Fortiweb waf signature is unauthorized"

date=2014-04-10 time=16:00:02 log_id=11005901 msg_id=000000734621 device_id=FV-1KD3A13800027 vd="root" timezone="(GMT-8:00)Pacific Time(US&Canada)" type=event subtype="system" pri=critical trigger_policy="" user=daemon ui=daemon action=update status=failed msg="Fortiweb ip intelligence signature is unauthorized"

date=2014-04-10 time=17:00:02 log_id=11005901 msg_id=000000189416 device_id=FV-1KD3A13800012 vd="root" timezone="(GMT+8:00)Beijing,ChongQing,HongKong,Urumgi" type=event subtype="system" pri=information trigger_policy="" user=daemon ui=daemon action=update status=failed msg="Fortiweb ip reputation signature is already up-to-date"

date=2014-04-10 time=17:00:02 log_id=11005901 msg_id=000000158889 device_id=FV-1KD3A13800012 vd="root" timezone="(GMT+8:00)Beijing,ChongQing,HongKong,Urumgi" type=event subtype="system" pri=error trigger_policy="" user=daemon ui=daemon action=update status=failed msg="update failed failed to connect fds server!"

date=2014-04-10 time=17:00:02 log_id=11005901 msg_id=000000070564 device_id=FV-1KD3A13800012 vd="root" timezone="(GMT+8:00)Beijing,ChongQing,HongKong,Urumgi" type=event subtype="system" pri=error trigger_policy="" user=daemon ui=daemon action=update status=failed msg="Fortiweb virus extend signature update failed"

date=2014-04-10 time=17:00:02 log_id=11005901 msg_id=000000068286 device_id=FV-1KD3A13800012 vd="root" timezone="(GMT+8:00)Beijing,ChongQing,HongKong,Urumgi" type=event subtype="system" pri=information trigger_policy="" user=daemon ui=daemon action=update status=failed msg="Fortiweb virus engine update succeeded"

date=2014-04-10 time=09:36:15 log_id=11005901 msg_id=000000022248 device_id=FVVM00UNLICENSED vd="root" timezone="(GMT-8:00)Pacific Time(US&Canada)" type=event subtype="system" pri=critical trigger_policy="" user=daemon ui=daemon action=update status=failed msg="License status changed to VALID"

date=2014-04-10 time=09:36:15 log_id=11005901 msg_id=000000104120 device_id=FVVM00UNLICENSED vd="root" timezone="(GMT-8:00)Pacific Time(US&Canada)" type=event subtype="system" pri=critical trigger_policy="" user=daemon ui=daemon action=update status=failed msg="License status changed to INVALID"

Log Message Reference

11005901

11005901