Explorer III

Question

FortiSIEM Collector Upgrade Issue

Forum|Forum|2 years ago
January 23, 2024
23 replies
12046 views

Hi,

I upgraded supervisor from 7.0.2 to 7.1.1. When I want to use Collector, I get the error "Operation timed out. Collector is not responding." What is the reason? Image is installed, but I cannot action>download.

Ekran görüntüsü 2024-01-23 150326.png

FSM_FTNT

Staff

From a shell on the collector, what is the output of the command phstatus

If you check the logs /opt/phoenix/logs/phoenix.log for any errors

adem_netsysAuthor

Explorer III

Hi @FSM_FTNT

all service up of phstatus now

FSM_FTNT

Staff

Next step would be to check for errors in phoenix log.

From the collector can you reach the super (IP or hostname) curl -k https://<super IP or DNS name>

What does the health screen show with these columns?

health-col.png

khanchand

Explorer II

Hi,

copy the Supervisor's host name in ADMIN > License > Nodes and in collector /etc/hosts file make the local entry to resolve supervisor IP address with its hostname. after that you will be able to download the image on collector.

Because Supervisor create a URL for the Collectors to download the image. It is critical to set the host name in the URL correctly so that a Collector can resolve the host name.

adem_netsysAuthor

Explorer III

Hi @khanchand

Should there be collector ip and hostname in collector?

khanchand

Explorer II

In collector /etc/hosts file put an entry <supervisor IP> <Supervisor Hostname>.

So that collector can resolve supervisor IP with its hostname.

Gerkhan

Visitor III

I upgraded the Super from 7.0.1.0038 to 7.1.3.0165 succesfully. The Collector version is also 7.0.1.0038 and i would like to upgrade to 7.1.3.0165. The popup window says, that the upgrade was successful, but the version not changed in Admin>Health>Collector Health window.

Goutham_FTNT

Staff

Hi,

This is because collector is not responding to the request sent from Super
Make sure collector can resolve correct Super hostname Admin > License > Node > The hostname for super from this page - Collector needs to have DNS record for this hostname

Gerkhan

Visitor III

I have already added the hostname and the IP address to /etc/hosts, or do you mean something else?

Goutham_FTNT

Staff

Hi Gerkhan,

So my update was for the "Collector is not responding" error

In your case - the upgrade is happening but the version is not getting updated
When you run phshowVersion.sh on the collector - You notice same version ?
If yes, then there could be an issue with uploaded image - You can re-upload the image to Super in Image server
After this on Super check if the image version is correct here - /opt/phoenix/CollectorUpgrade

Once you download image and run install image to the collector - Check the logs from /opt/phoenix/log/ -- Here you can find a log for the upgrade when it is triggered which should give more information about the failure

KarlH

Explorer II

Hello,

I am also noticing this same issue. But the collectors are already registered , and reporting and showing healthy in the Admin Collector health view. I am still getting this error when I try to Download. But how are they reporting and reading the supervisor queue? As I understand the Collectors read the queue very few seconds on the supervisor, if the collectors are already sending data to supervisor how are they doing this without /etc/host file entry entry assuming that's the issue?

~Karl

adem_netsysAuthor

Explorer III

Hi @Goutham_FTNT @FSM_FTNT

Is there a command or method that I can upgrade Collector via CLI as an alternative to image?

KarlH

Explorer II

HI yes

Yes you can upgrade the collector via the CLI, you need to copy the upgrade image to the collectors and then copy phcollectorimageinstaller.py to the collector there may be one on the collector in the directory indicated. and it may be the same I believe the rule of thumb is to use the Supervisor version

But first get the .zip file onto the collector.

copy the file to /opt/upgrade
#chmod 664 /opt/upgrade/FSM_Upgrade_All_7.1.3_build0165.zip

run the bellow command

#screen -S upgrade

then run

#/usr/bin/python /opt/phoenix/phscripts/bin/phcollectorimageinstaller.py FortiSIEM |tee -a /opt/phoenix/log/collector-upgrade.log

Sign up

Login with SSO

Login to the community

Login with SSO