Technical Tip: FortiSIEM GUI displays 504 Gateway timeout during large queries

Description

This article describes that in some environments, users may observe intermittent '504 Gateway Timeout' errors while performing large event searches, running complex analytics queries, or loading dashboards in FortiSIEM GUI.

Scope

FortiSIEM.

Solution

This issue is commonly seen when:

• Queries return very large datasets.

• System resources are under heavy utilization.

• ClickHouse or backend services respond slowly.

• Multiple users execute concurrent searches.

Symptoms:

Users may encounter the following: 

• The GUI becomes inaccessible temporarily.

• Browser displays: 504 Gateway Timeout.

• Slow dashboard loading.

• Incident or analytics searches are timing out.

Root Cause:

The issue may occur due to:

• Heavy analytics queries are consuming high CPU or memory.

• Backend database response delays.

• Large event searches without proper filters.

• Resource exhaustion on the Supervisor node.

• Long-running ClickHouse queries.

Troubleshooting steps.

1. Check System Resource Utilization.

Run the following commands on the Supervisor:

top

free -h

df -h

Verify CPU, memory, and disk utilization.

2. Verify running queries.

Check currently running ClickHouse queries:

clickhouse-client

SELECT * FROM system.processes;

Identify long-running or resource-intensive queries.

3. Review backend logs.

Check for timeout-related messages:

tail -f /opt/phoenix/log/phoenix.log

4. Reduce query scope.

• Use shorter time ranges.

• Apply filters.

• Avoid wildcard-heavy searches.

• Limit result size.
  
  

Resolution.

• Optimize large queries.

• Increase system resources if utilization is consistently high.

• Ensure adequate storage performance.

• Upgrade to the latest supported FortiSIEM version.

• Monitor ClickHouse query execution regularly.