Technical Tip: No incidents generated due to phMonitorSupervisor PID write error in FortiSIEM

Symptoms.

• No incidents are generated or displayed in the Incident tab.

• Some phProcesses are down.

• Error observed in backend logs: 

[PH_BASE_PROC_SET_PID_FILE_FAILED]:[eventSeverity]=PHL_ERROR,[procName]=phMonitorSupervisor,[fileName]=phBaseProcess.cpp,[lineNumber]=1241,[filePath]=/opt/phoenix/cache/run/phMonitorSupervisor.pid,[errorString]=,[phLogDetail]=Failed to set pid file in base process. Reason: cannot open pid file of /opt/phoenix/cache/run/phMonitorSupervisor.pid for write (err=)

To resolve this issue, follow the steps below:

1. Recreate the missing file path:

su - admin -c "mkdir -p /opt/phoenix/cache/run"

2. Make sure proper permissions are set for the required directories:

la -la /opt/phoenix/cache

3. Restart all FortiSIEM processes:

phtools --stop ALL
phtools --start ALL

After completing the steps above, incidents should be generated and visible in the Incident tab, and all phProcesses should be running normally.