FortiSIEM Collector Buffer Filling Up – Collector Uploading to Its Own IP

Hello,

In our FortiSIEM environment, we are receiving the following health warning:

---> Event Pipeline: Warning (Collector Buffer between 20MB and 50MB)

After checking the logs, I observed that the collector is trying to upload events to a worker, and the destination IP is the collector’s own IP address. However, we are not using any workers in this deployment – only a Supervisor and a Collector.

Because of this, the collector keeps sending HTTP requests to itself, receives a failed response, and then writes the events into:

" /opt/phoenix/cache/parser/events/ "

This continuously increases the collector buffer size.

As a temporary workaround, I manually delete the .dat files in that directory, which clears the warning, but the issue reappears after a short while because the collector continues to target its own IP.

What would be the correct permanent solution for this issue?

Best Regards,

İsmail Ürek