Troubleshooting Tip: Event Integrity validation for random event files remain 'Not validated' as validation fails with error 'fileValidationResponse: file not found' in backend logs
| Description | The article provides troubleshooting steps for issues with event integrity validation for random event files that remain 'Not validated' in EventDB-based FortiSIEM deployment. |
| Scope | FortiSIEM with EventDB (/data) as event storage. |
| Solution | Event integrity validation from ADMIN -> Settings -> Event Integrity shows 'Not validated' for random event files with 'fileValidationResponse: file not found' error in log file /opt/phoenix/log/phoenix.log as the event file actually does not exist in event storage (/data).
grep -E 'CORRUPTED|UNABLE_CREATE_DIR' /opt/phoenix/log/phoenix.log
rm <eventFilePath>
chown -R admin.admin /data/eventdb/ chown -R admin.admin /archive/
killall -9 phDataManager |
