Skip to main content
Explorer
September 9, 2026
Question

FortiSIEM HA — Migration from Environment 1 to Environment 2 and Promotion of the New Environment

  • September 9, 2026
  • 3 replies
  • 104 views
Hello everyone. I am finalizing a FortiSIEM HA migration and am facing significant difficulties in completing the process stably. The goal is to completely decommission Environment 1—currently acting as the primary environment—and promote Environment 2 to take over as the new primary FortiSIEM environment. During the process, I encountered inconsistencies involving Patroni, etcd, PostgreSQL, and node synchronization. Even after reconfiguration, references and records from the previous environment can persist in the cluster, hindering the establishment of Environment 2 as the new Leader and the formation of a stable HA setup. I would like to know if anyone has performed this type of transition and could share their experience—specifically regarding the permanent removal of Environment 1, the promotion of Environment 2 as the new primary environment, the cleanup of old references in Patroni and etcd, HA reconfiguration, and validation steps to preserve the CMDB, database, events, and services. If anyone has encountered this scenario and can share the procedure used, best practices, or key considerations, I would greatly appreciate it.

HELP!!!

I don't know what to do anymore.

3 replies

Anthony_E
Staff
Staff
September 10, 2026

Hi,

I invite you to post your FortiSIEM question directly on the FortiSIEM group:

https://community.fortinet.com/groups/fortisiem-216

Best Regards
Explorer
September 10, 2026

Man, I feel your pain—stale etcd/Patroni metadata is almost certainly what's blocking your Leader election.

Here's the TL;DR to fix it:

Clear etcd state: Use etcdctl to remove old Env 1 endpoints and purge the Patroni DCS dynamic config key so it drops the cached dead nodes.

Fix Patroni Leader: Run patronictl topology on Env 2, then use patronictl edit-config to strip Env 1 references and force Env 2 as Leader.

Clean DB metadata: Update Supervisor tables (like dao_node) to remove old IP/host entries before adding secondaries.

Restart order: Stop phStateMaster & FortiSIEM services -> get Patroni/Postgres healthy on Env 2 (patronictl list) -> start FortiSIEM services back up.

If this is prod, open a P1 TAC case ASAP—they have internal scripts to scrub old node mappings safely without touching your CMDB or event logs. Hang in there!

Stephen_G
Staff & Editor
Staff & Editor
September 10, 2026

Hi Wesley Gama,

I’ve moved your post to the FortiSIEM group.

Stephen_G - Fortinet Community Team
Thought Leadership. Security Summit. Thursday, November 12th, PGA National Resort, Palm Beach Gardens, FL.
Thought Leadership. Security Summit. Thursday, October 8th. Disney's Grand Californian Hotel & SPA, Anaheim, CA.
Security Operations Summit: Modernize SecOps. Operate AI-Native.AMER: November 4 | 9:00 AM PST. India and SAARC: November 5 | 10:00 AM IST. EMEA: November 5 | 10:30 AM CET. APAC: November 5 | 11:00 AM SGT