Skip to main content
aebadi
Staff
Staff
January 17, 2025

Technical Tip: FortiSIEM HA Cluster- How to force a reelection and appoint a new designated leader

  • January 17, 2025
  • 0 replies
  • 1368 views
Description This article describes how to force reelection on an HA cluster and designate a new Leader Solution.
Scope FortiSIEM v7.3.0.
Solution

Two commands will force a reelection depending on the health of The cluster:

 

A>patronictl failover <----- Performs a manual failover in the cluster. This command should be run when the cluster is not in a healthy state.
B> patronictl switchover

 

There is a warning associated with this command that Triggering a failover can cause data loss depending on how up-to-date the promoted replica is in comparison to the primary.

Examples of a cluster that does not begin healthy are if there is no leader or if some processes are down i.e... etcd, patroni or raft-related processes.

 

  1. Run a list to show information about the cluster and its members:

 

[root@super-1 ~]# patronictl list
+ Cluster: fortisiemHA (7444645528849998461) --+----+-----------+
| Member | Host | Role | State | TL | Lag in MB |
+---------+--------------+---------+-----------+----+-----------+
| super-1 | 10.65.49.160 | Replica | streaming | 7 | 0 |
| super-2 | 10.65.49.161 | Leader | running | 7 | |
| super-3 | 10.65.49.162 | Replica | streaming | 7 | 0 |
+---------+--------------+---------+-----------+----+-----------+

 

  1. Run the Failover command to force the reelection and choose which host to designate as the new Leader:

 

[root@super-1 ~]# patronictl failover
Current cluster topology
+ Cluster: fortisiemHA (7444645528849998461) --+----+-----------+
| Member | Host | Role | State | TL | Lag in MB |
+---------+--------------+---------+-----------+----+-----------+
| super-1 | 10.65.49.160 | Replica | streaming | 7 | 0 |
| super-2 | 10.65.49.161 | Leader | running | 7 | |
| super-3 | 10.65.49.162 | Replica | streaming | 7 | 0 |
+---------+--------------+---------+-----------+----+-----------+
Candidate ['super-1', 'super-3'] []: 

 

In the example above the Failover command is asking which host to designate, for this example super-3 is designated as the new leader and press [y] to start the new election and promote super-3 as the new leader:

 

Candidate ['super-1', 'super-3'] []: super-3
Are you sure you want to failover cluster fortisiemHA, demoting current leader super-2? [y/N]: y
2025-01-15 07:57:43.66408 Successfully failed over to "super-3"
+ Cluster: fortisiemHA (7444645528849998461) +----+-----------+
| Member | Host | Role | State | TL | Lag in MB |
+---------+--------------+---------+---------+----+-----------+
| super-1 | 10.65.49.160 | Replica | running | | 0 |
| super-2 | 10.65.49.161 | Replica | stopped | | unknown |
| super-3 | 10.65.49.162 | Leader | running | | |
+---------+--------------+---------+---------+----+-----------+

 

  1.  Run a new list command and verify that the new leader has been elected:

 

[root@super-1 ~]# patronictl list
+ Cluster: fortisiemHA (7444645528849998461) --+----+-----------+
| Member | Host | Role | State | TL | Lag in MB |
+---------+--------------+---------+-----------+----+-----------+
| super-1 | 10.65.49.160 | Replica | streaming | 7 | 0 |
| super-2 | 10.65.49.161 | Replica | running | 7 | |
| super-3 | 10.65.49.162 | Leader | streaming | 7 | 0 |
+---------+--------------+---------+-----------+----+-----------+

 

 

If the HA Cluster is in a healthy state and to elect a new HA leader, then patronictl switchover is the correct command to force a switchover in the cluster.

 

  1. Run a list to show information about the cluster and its members:

 

[root@super-1 ~]# patronictl list
+ Cluster: fortisiemHA (7444645528849998461) --+----+-----------+
| Member | Host | Role | State | TL | Lag in MB |
+---------+--------------+---------+-----------+----+-----------+
| super-1 | 10.65.49.160 | Replica | streaming | 7 | 0 |
| super-2 | 10.65.49.161 | Leader | running | 7 | |
| super-3 | 10.65.49.162 | Replica | streaming | 7 | 0 |
+---------+--------------+---------+-----------+----+-----------+

 

  1. Run the patronictl switchover command that is asking for the current leader and gives the option to promote a host in the cluster as the new leader:

 

[root@super-1 ~]# patronictl switchover
Current cluster topology
+ Cluster: fortisiemHA (7444645528849998461) --+----+-----------+
| Member | Host | Role | State | TL | Lag in MB |
+---------+--------------+---------+-----------+----+-----------+
| super-1 | 10.65.49.160 | Replica | streaming | 8 | 0 |
| super-2 | 10.65.49.161 | Replica | streaming | 8 | 0 |
| super-3 | 10.65.49.162 | Leader | running | 8 | |
+---------+--------------+---------+-----------+----+-----------+
Primary [super-3]: super-3
Candidate ['super-1', 'super-2'] []


In the example above super-3 is the current leader and chose super-2 to promote as the new leader and press [now] and [y] to start the new election now and promote super-2 as the new leader:

 

Candidate ['super-1', 'super-2'] []: super-2
When should the switchover take place (e.g. 2025-01-15T09:09 ) [now]: now
Are you sure you want to switchover cluster fortisiemHA, demoting current leader super-3? [y/N]: y
2025-01-15 08:09:26.28558 Successfully switched over to "super-2"
+ Cluster: fortisiemHA (7444645528849998461) +----+-----------+
| Member | Host | Role | State | TL | Lag in MB |
+---------+--------------+---------+---------+----+-----------+
| super-1 | 10.65.49.160 | Replica | running | | 0 |
| super-2 | 10.65.49.161 | Leader | running | | |
| super-3 | 10.65.49.162 | Replica | stopped | | unknown |
+---------+--------------+---------+---------+----+-----------+

 

  1. Run a new list command and verify that the new leader has been elected:

 

[root@super-1 ~]# patronictl list
+ Cluster: fortisiemHA (7444645528849998461) --+----+-----------+
| Member | Host | Role | State | TL | Lag in MB |
+---------+--------------+---------+-----------+----+-----------+
| super-1 | 10.65.49.160 | Replica | streaming | 9 | 0 |
| super-2 | 10.65.49.161 | Leader | running | 9 | |
| super-3 | 10.65.49.162 | Replica | streaming | 9 | 0 |
+---------+--------------+---------+-----------+----+-----------+
[root@super-1 ~]#

 

    Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
    Fortinet Flag the Hack. Wednesday, August 26, 9:00 AM - 5:00 PM ET, COSM, Atlanta, GA.