Skip to main content
Jesisidabuliu
Jesisidabuliu
New Member
October 24, 2023
Question

No File and Event Time Received after i move my collector to another server.

  • October 24, 2023
  • 2 replies
  • 2287 views

I didn't make any changes to the settings; I simply turned everything off, moved the collector to another server, and then turned them on one by one (collector > worker > supervisor). The status got updated, but It didn't receive any files and event times.

 

 

1.jpg

    2 replies

    Jesisidabuliu
    JesisidabuliuAuthor
    New Member
    October 24, 2023

    Case Closed .. i should turn on collector after fortisiem ..

      Secusaurus
      Secusaurus
      Contributor III
      October 24, 2023

      Glad you found the solution.

      In many cases, it also helps stopping and starting the collector via GUI. Usually you see that some of the processes on the collector are not working under the Health panel on the supervisor.

      NSE8 | Fortinet Advanced MSSP Partner
      thiago_inorpel
      thiago_inorpel
      Explorer II
      February 13, 2025

      Hey guys.
      We are facing this same issue after installing and registering the collector on our instance. Both in MEA collector (docker) and in VM collector in external networks. Our collectors that serve our internal environment are working without problems. However, these other collectors that are external have this problem. We have already stopped and started the collectors through the supervisor GUI, but the problem continues, as well as restarting the collector processes and nothing. Are there any chances of this being network problems? The "last status updated" option is updated and shows communication, but we do not receive EPS from the collectors precisely because the Last File Received option and/or last event time are N/A. Any help is welcome, thank you

      image.png

       

      Secusaurus
      Secusaurus
      Contributor III
      February 13, 2025

      Hi @thiago_inorpel,

       

      The collectors communicate to the Supervisor for status info and Workers for the events. In case you do not have an all-in-one-setup, make sure the Collectors are able to reach the Workers as well.

      Also note, that you need to define the Supervisor and Worker addresses/FQDNs manually in the GUI (cluster config and/or override in organization setup).

       

      In case you used FQDNs here, a common issue is that the DNS server is not able to deliver the correct IP (public DNS, internal FQDN). In case of IPs, a common issue is that you used internal IPs instead of the public ones (DNAT/VIP).

       

      In any case, first step of troubleshooting might be to SSH on the Collector and ping the cluster, then curl https://(yourDefinedAddresses)/ your cluster.

       

      Best,

      Christian

      NSE8 | Fortinet Advanced MSSP Partner
        thiago_inorpel
        thiago_inorpel
        Explorer II
        February 14, 2025

        Your analysis was fundamental. We made sure and saw that the collectors were not able to see the workers, so when we adjusted this, we immediately stopped and started the collectors in the GUI interface, waited a while and it was like magic, they started sending events. The VM collectors respond normally now, but the MEA (Analyzer) collectors still have this problem, anyway, I believe I know how to act from here. Thank you very much!

        Terms & ConditionsAccessibility statement