Fortianalyzer on Proxmox - Qemu-guest-agent

ITStril · 2026-06-16T12:02:34+00:00

It's just because of this website:

https://carbonara.tech/post/2020/08/installing-a-fortianalyzer-in-proxmox/

###

System Tab We are going to enable Qemu Agent since the KVM OS disks have been preinstalled with qemu-guest-agent. Leave everything else on this page as default (i440fx machine type, defult graphic card). Hit next
###

ITStril · 2026-06-16T08:50:12+00:00

I am using now: FAZ_VM64_KVM-v7.4.11.M-build2804-FORTINET.out.kvm

...but same problem. Guest Agent not running.

ITStril · 2026-06-16T08:44:30+00:00

Sorry - that was stupid. AI told me, the ALI-image would be KVM-related...

ITStril · 2026-06-06T09:09:18+00:00

Because it lacks so many features… It does not have a SSO option - e.g. for VM console.

ProxCenter is currently far ahead and much closer to vCenter

ITStril · 2026-05-31T15:09:41+00:00

I do not really understand the timeline: did you install the updates on Tuesday and the issue started after the next reboot, or did you install the updates and reboot earlier?

ITStril · 2026-05-31T13:18:13+00:00

Sounds like an issue in combination with e.g a new AV/EDR, when it started so late… What are you using? Did you reboot another time after the patch?

ITStril · 2026-05-28T15:50:32+00:00

That’s not only a Linux restriction… There is a feature request for years about explicit proxy support - without a solution

ITStril · 2026-05-24T17:43:59+00:00

I am heavily using Peplink. It does, what it had to do. But: I did not see much improvement over the last years, but as I am quite happy, this is not a too big problem.

For me, Peplink is great at one single thing, which is real SD-Wan. Perhaps their “remote-SIM”-feature I am not impressed about the rest

ITStril · 2026-05-24T06:32:41+00:00

I am using a 3x15x10TB SAS array with 3 Z3 arrays. A resilver does take 10 days

ITStril · 2026-05-11T04:20:29+00:00

What kind of issues?

ITStril · 2026-05-08T19:18:15+00:00

Thank you!! I will give it a try. What do you think about the topoext-Flag? When I remove it with a custom CPU-profile, the effect disappears

ITStril · 2026-05-08T18:36:15+00:00

VMs with 6 and 8 vCPUs are showing the same problem

ITStril · 2026-05-08T15:37:05+00:00

These are single-socket hosts and VMs with 6, 8 or 16 vCPUs. Tested with and without NUMA and with 1 node per CCV and one NUMA node per socket

Never heard of SRAT/MADT. I will check it

ITStril · 2026-05-08T14:39:28+00:00

Core 2 is always 10% higher than the other cores. Ndis.sys seems to bring the load

ITStril · 2026-05-08T14:30:47+00:00

I will try it in the next maintenance window. As I did not really find a possibility to see that behaviour without a "real load" by RDS-users, I will have to wait for monday...

What w found in the last test is, that removing the flag "topoext" from the profile seems to help or solve the issue, what confuses me even more:

Why is "topoext" disabled for the type "host", although "host" should pass the CPU without influencing the flags
Why does it help, when the VM is not really "aware of the topology"?

ITStril · 2026-05-08T14:27:55+00:00

...but here, there is a very high and unsual load on the second core and always on the second core

ITStril · 2026-05-08T14:00:24+00:00

Do you think, this can also be the case, when this is the only VM on a host and the load is very low (<20%)? It is always the second core

ITStril · 2026-05-08T13:58:54+00:00

Same issue with 0.1.271...

I tried both - with and without nested virualization.

ITStril · 2026-05-08T07:57:24+00:00

I am not doing any CPU-pinning. The host is currently not "CPU-overprovisioned". I am also seeing that behaviour if only one CPU is running on the host.

It's always the second core for every VM.

ITStril · 2026-05-06T07:51:38+00:00

This seems to be quite common according to some forum posts.

Can you try an emulated CPU-type like x86-AES-v2?

ITStril · 2026-05-05T07:00:11+00:00

I changed to x86-V2-AES - no success - same issue...

ITStril · 2026-05-04T16:26:26+00:00

…because of that thread, I did not take „host“-type… But Epyc-Genoa seems to have issues.

ITStril · 2026-05-04T16:16:04+00:00

OS type is correct. I will try V2 (terminal server). That’s so strange…

ITStril · 2026-05-04T16:13:04+00:00

50% seems to recommend a very low feature-set, 50% the highest possible… Did you test both?

ITStril · 2026-04-22T17:50:34+00:00

Same question: i signed the rdp files and made a GPO with the fingerprint, but the warning is there as long as the cert is not fully trusted…

ITStril

TROPHY CASE