Technical Tip: How to fix 'PH_DROP_EVENT_FROM_SHARED_BUFFER' error
| Description | This article describes the steps to apply to resolve the error 'PH_DROP_EVENT_FROM_SHARED_BUFFER'. |
| Scope | FortiSIEM. |
| Solution | The main cause for the 'PH_DROP_EVENT_FROM_SHARED_BUFFER' error is Full Queue drops by the Workers.
Remove the files from the cache - To DO ON SUPER/WORKERS DURING DOWNTIME - Take a snapshot first:
cd /opt/phoenix/cache/<SUPERIP>/phoenix/rest/dataRequest/rule/ mv /opt/phoenix/cache/<SUPERIP> /opt/phoenix/cache/SUPERIP.old
Now change this from:
notification_server_thread_num=20
To:
notification_server_thread_num=50 -> Search for 'count_distinct_precision'.
Modify the value to the below:
count_distinct_precision=9
Save the configuration and exit the file.
killall -9 phMonitor phRuleWorker phRuleMaster
killall -9 phRuleWorker
phstatus |
