Skip to main content
gauravpawar
gauravpawar
Explorer III
July 6, 2026
Question

FortiSIEM Active-Active HA deployment failed

  • July 6, 2026
  • 2 replies
  • 52 views

Hello Team,

We need some guidance regarding a FortiSIEM Active-Active HA deployment. Version 7.4.2

Current Environment

  • We currently have 1 Supervisor node running in production.
  • Our plan is to add 2 additional Supervisor nodes to build an Active-Active HA cluster.

What Happened

  1. We initially generated the HA certificates using the root user.

  2. While adding the two new Supervisor nodes to the HA cluster, the process failed with the error:

    "The database application fails."

  3. Fortinet Support removed the HA nodes, and the existing environment was restored to a healthy state.

Current Status

After the cleanup, we attempted to configure the HA cluster again with correct certificates , but we were still unable to successfully add the Supervisor nodes to the HA cluster.

While investigating, we observed that the existing Supervisor already has the following services running:

  • patroni
  • etcd

Our Plan

We are planning to retry the HA deployment once more, this time by generating the certificates correctly using the admin user instead of root.

Questions for the Community

  • Since patroni and etcd services are already running on the existing Supervisor, is it safe to proceed with the automated Active-Active HA setup?
  • Do these services indicate that remnants of a previous HA configuration still exist and need to be cleaned up before attempting the deployment again?
  • Even after Fortinet Support removed the failed HA nodes, we were still unable to add the HA nodes successfully. Could these running services be the reason?

Any guidance or best practices from members who have successfully deployed FortiSIEM 7.4.x Active-Active HA would be greatly appreciated.

Thank you in advance for your help!

    2 replies

    Muttahar_Rehman
    Muttahar_Rehman
    Explorer
    July 6, 2026

    Why It's Failing

    When Fortinet Support removed the HA nodes via GUI, it only cleaned the management plane it did NOT clean the OS-level patroni/etcd state on S1. So S1 still has stale cluster data, and every new HA attempt collides with it.

    SSH into S1 as root, then reset the DB cluster state:
    /opt/phoenix/deployment/jumpbox/phresetdbclusternode

    Reboot:

    After reboot, confirm services are clean:
    systemctl status etcd
    systemctl status patroni
     

    Confirm S1 is healthy before touching anything else:
    GUI → Admin > Health > Cloud Health → all green.
     

    Then Retry HA Setup Normally

    Only after all nodes are confirmed clean, proceed with the standard HA formation from Step 0 (collect SSH keys, add S2/S3 via GUI, form DB cluster)

    Thanks, R3hsec
      gauravpawar
      gauravpawarAuthor
      Explorer III
      July 13, 2026

      ​@Muttahar_Rehman Thanks for the help, I have one doubt do we have to run the same command on “Failed Nodes” as well i.e., on S2 and S3 ? I found a document which says so .

      Document link -https://docs.fortinet.com/document/fortisiem/7.4.2/high-availability-and-disaster-recovery-procedures-clickhouse/904233

      Adding a Failed DB Server or Supervisor with DB Node to the DB Server Cluster

      If DB Server or Supervisor with DB node has failed and you want to add it back to the DB Server cluster, then perform these steps:

      1. If Supervisor with DB node failed, power it down.

        Note: If you delete a Supervisor with DB node using the GUI while it is not powered down, the node will change to Supervisor without DB.

      2. Login to GUI.

      3. Go to Admin > License > Nodes.

      4. Select the node and click Delete.

      5. Power up the Supervisor with DB node that failed.

      6. SSH to the failed node as root.

      7. Run the following command.

        /opt/phoenix/deployment/jumpbox/phresetdbclusternode

      8. Go to Admin > License > Nodes, select the node and click Add.

      9. Go to Admin > Settings > System > Cluster Config, DB Cluster, and join the node to the DB Cluster.

      Terms & ConditionsAccessibility statement