Skip to main content
gwaihir
Explorer II
November 20, 2023
Solved

phAnomalyWorker & phAnomalyMaster services DOWN

  • November 20, 2023
  • 7 replies
  • 3162 views

Greetings

 

Hi guys, can I get some help with this issue please, these services are DOWN, running FortiSIEM 7.2 on Rocky Linux 8.8 (Green Obsidian) after fresh install it went down.

 

(see the image)

CaptureFSM.PNG

 

Thank you!

Best answer by premchanderr

hi @Gwamm  and @Antonio2022 ,

 

As per release notes FortiSIEM 7.0.0, 7.0.1 and 7.0.2 cannot be installed with FIPS option.

 

If you have this option enabled, can you schedule a downtime and disable this. 

Steps to disable FIPS:

- Take a snapshot of VM, so can revert in case of issue.
- Run configFSM.sh, select the following to disable FIPS
i. Set Time Zone: Select "2 No"
ii. Select what you would like to configure: Select "1 Supervisor"
iii. Select operation: select "disable_fips"
iv. Run Configuration Command: Select "Run"

 

Link: https://docs.fortinet.com/document/fortisiem/7.0.2/release-notes/911411/whats-new-in-7-0-2

 

7 replies

Anthony_E
Staff
Staff
November 23, 2023

Hello,


Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.


Thanks,

Best Regards
Anthony_E
Staff
Staff
November 28, 2023

Hello,

 

We are still looking for someone to help you.

We will come back to you ASAP.


Regards,

Best Regards
Antonio2022
New Member
November 28, 2023

I am having the same issue where 'phAnomalyWorker' is 'down' in two workers after an upgrade.

The worker was rebooted two times and phAnomalyWorker still down.

premchanderr
Staff & Editor
Staff & Editor
November 30, 2023

hi @Gwamm  and @Antonio2022 ,

 

As per release notes FortiSIEM 7.0.0, 7.0.1 and 7.0.2 cannot be installed with FIPS option.

 

If you have this option enabled, can you schedule a downtime and disable this. 

Steps to disable FIPS:

- Take a snapshot of VM, so can revert in case of issue.
- Run configFSM.sh, select the following to disable FIPS
i. Set Time Zone: Select "2 No"
ii. Select what you would like to configure: Select "1 Supervisor"
iii. Select operation: select "disable_fips"
iv. Run Configuration Command: Select "Run"

 

Link: https://docs.fortinet.com/document/fortisiem/7.0.2/release-notes/911411/whats-new-in-7-0-2

 

gwaihir
gwaihirAuthor
Explorer II
November 30, 2023

Thank you for your help, hope this can be solved with next releases.

Himanshu735
New Member
January 3, 2025

Hi Prem

i have single site HA  Deployed without Fips. but after the Failover phanomely worker is down. and phmonitor is flactuate. can you solve this query

S0ck-Pupp3t
Explorer III
October 6, 2025

So I'm seeing this issue on a worker after an upgrade from 7.3.4 to 7.4.1. Just phAnomalyWorker, though. Nothing else. 

Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
Virtual event | September 2026. SASE summit. The age of autonomous trust. Register here!