Technical Tip: How to remove an old supervisor from a FortiSIEM collector

To remove the old supervisor from the collector, first disassociate the Old Supervisor from the Collector:

1. Remove the collector from the GUI (Old Supervisor).
2. Check the PostgreSQL database to verify that the collector has been removed:

psql -U phoenix phoenixdb
select * from ph_sys_collector; server
\q

3. Remove the license from the collector:

cd /etc/opsd
ls –la
rm –f <----- Insert the file that is there - either .phoenixXXXXXX or .fortisiemXXX.
reboot now

4. Add the collector in the GUI via the New Supervisor.
   
   
5. Register the collector using the following command:

phProvisionCollector --add <Organization-user-name> <Organization-user-password> <Supervisor-IP> <Organization-name> <Collector-name>

After the registration is complete, the collector should restart automatically.

6. Check the PostgreSQL database to see if the collector has been assigned a Natural ID.

psql -U phoenix phoenixdb
select * from ph_sys_collector;
\q

7. Check the GUI/collector health.