How to correctly re-register a Collector all ph procs are down.

Question

! collector was registered at one pointlost the passwordupdated password then tried to run phtools start allprcos are down and will not come up. /opt/phoenix/bin/phProvisionCollector --add admin 'biglong pw' siem vendor orgContinuing to provision the CollectorFailed to register collector!Cause:The organization "130862006-vendor" has already registered a collector with name "collector name" (But we had to change the credentials) Do these procedures still apply  to re-register a collector?  after getting the above error  , all their ph procs are down.  :1. SSH to FortiSIEM Supervisor2. Enter the following command to login into PSQL:        #psql -U phoenix phoenixdb    3. Update the PSQL Database:        =>ph_sys_collector set natural_id='' where name=<collector name>;    4. Quit PSQL:        =>\q    5. Re-register the Collector to Supervisor. Find in the related articles bellow "How to register a Collector or Super".    Revised:    In step 3 full synxax => update ph_sys_collector set natural_id = '' where name = 'collector name'  phtools --start all[PH_MODULE_LOCAL_CONFIG_LOADED]:[eventSeverity]=PHL_INFO,[procName]=phtools,[fileName]=phConfigLoader.cpp,[lineNumber]=168,[configName]=global,[phLogDetail]=Module loaded local config successfully[PH_LICENSE_ERROR]:[eventSeverity]=PHL_ERROR,[procName]=phtools,[fileName]=phInstalledLicense.cpp,[lineNumber]=170,[errorString]=License Error: Please request new license from support, thanks!,[phLogDetail]=License error, please contact support.  Is it  a License issue? Do we investigate the phoenix log?

premchanderr · Accepted Answer

Hi @KarlH ,This is the command to update:# /opt/phoenix/bin/phProvisionCollector --update '' For delete there is no command. Before deleting a collector, we must ensure no devices are pointing to this collector in CMDB. CMDB > Devices > Discovered by > Select the collector we want to delete from the drop-down. If devices are showing up under this collector, that is the root cause of this error. Please move those devices to a different collector. Select the device > Edit > Collector > Select a different collector from the drop-down. If there is no device under the collector, now you try to delete the collector from GUI. Go to Organization > Edit the org > select collector and delete.

kcanalichio · Answer

You can try using the phProvision --update to re-register.  Otherwise get with TAC or rebuild the collector.

Sign up

Login with SSO

Login to the community

Login with SSO