Skip to main content
Jackli
Jackli
New Member
March 13, 2026
Question

The collector upload buffer and memory usage are continuously increasing.

  • March 13, 2026
  • 3 replies
  • 267 views

Hi everyone,

I’m currently facing an issue where my collector’s upload buffer and memory usage are continuously increasing.

After some research, I found a potential fix related to PH_PARSER_FILE_STAT_FAILURE on a forum. However, when I attempted to execute the recommended commands (such as chmod and chown), I encountered "Permission Denied" and "Invalid User" errors, which prevented the fix from being applied.

Has anyone encountered this specific behavior before? Specifically:

  1. How do you properly resolve the PH_PARSER_FILE_STAT_FAILURE when the parser is under heavy load?

  2. What are the correct permission/ownership settings for the /opt/phoenix/cache/parser/ directory to avoid these errors?

Any assistance or guidance would be greatly appreciated. Thank you!

 

Troubleshooting Tip: How to troubleshoot collector... - Fortinet Community  螢幕擷取畫面 2026-03-13 102818.jpg

螢幕擷取畫面 2026-03-13 103131.jpg

 

    3 replies

    OkayArnoldLarue
    OkayArnoldLarue
    New Member
    April 6, 2026

    Thanks @mikechaos2 this actually helped me a lot. I had been searching for a solution for a long time for the same PH_PARSER_FILE_STAT_FAILURE issue, and fixing the directory ownership and permissions exactly like you said cleared up the errors. Restarting the service after that and checking the app stabilized everything for me too. Really appreciate the clear steps it saved me a lot of time.

    adem_netsys
    adem_netsys
    Explorer III
    April 7, 2026

    Hello guys,
    I’m also facing the increasing buffer issue, but I’m getting a different error in my collector.

    Do you have any idea?

     

    "ERROR,[procName]=phEventForwarder,[fileName]=phPlainNotificationServer.cpp,[lineNumber]=53,[errorString]=phAcceptor::accept error with errno : 24, duration 0 ms,[phLogDetail]=ACE failed to accept"

    Secusaurus
    Secusaurus
    Contributor III
    April 7, 2026

    Hi @adem_netsys,

     

    Sounds like a connection problem from Collector to Workers. There is a long KB, which does not mention this error but I tend to follow on any Collector issues: https://community.fortinet.com/t5/FortiSIEM/Troubleshooting-Tip-How-to-troubleshoot-collector-issues/ta-p/317859

     

    However, as soon as I spend more than 1 hour troubleshooting on a Collector, I usually decide to dump and recreate it. Setting up a collector is so much faster than trying to fix issues here ;)

     

    Best,

    Christian

    NSE8 | Fortinet Advanced MSSP Partner
    adem_netsys
    adem_netsys
    Explorer III
    April 7, 2026

    Hi @Secusaurus 

    Firstly, Thank you for your response. Actually, I've recreated collector but it does not any change still has same issue.

    merigens6
    merigens6
    New Member
    May 8, 2026

    That usually points to the parser getting stuck on unreadable files, so checking which user the collector actually runs under before changing ownership is often the real fix not just applying chmod blindly; small setup mismatches can cause bigger symptoms, a bit like with HDO Box Apk when one wrong permission breaks the flow.

    Terms & ConditionsAccessibility statement