Skip to main content
nsoni
Staff
nsoni
Staff
March 26, 2026

Troubleshooting Tip: FortiSIEM collector rejects events received via HTTP(s) POST method with 553 HTTP error response

  • March 26, 2026
  • 0 replies
  • 100 views
Description The article provides steps to fix the 553 HTTP error response from the FortiSIEM collector when events are forwarded by the HTTP(s) POST method.
Scope FortiSIEM collector.
Solution

Perform the following troubleshooting steps:

  1. Forward events to FortiSIEM collector via HTTP(s) POST method
    For steps, refer to the guide Ingesting JSON Formatted Events Received via HTTP(S) POST.

  2. Verify if the following logs are observed in the respective log files on the collector, which indicate a permission issue.

     

  • /var/log/httpd/ssl_access_log:


10.132.X.X - jsonuser [25/Mar/2026:21:21:55 +0530] "POST /rawupload?vendor=SAP&model=ETD&reptIp=192.0.2.20&reptName=LogForwarder1 HTTP/1.1" 553 527

 

  • /opt/phoenix/log/phoenix.log:


2026-03-24T21:20:52.645548+05:30 collector phEventHandler:

[PH_EVT_HANDLER_ERR]:[eventSeverity]=PHL_ERROR,[procName]=phEventHandler,

[fileName]=phHttpRequestHandler.cpp,[lineNumber]=326,

[phLogDetail]=could not create an unique file for uploaded content - errno=13, MkTry=100, Acc=0 for [/opt/phoenix/cache/parser/upload/http/SAP_ETD/1_XXXXXX]/[]/

[/opt/phoenix/cache/parser/upload/http/SAP_ETD/1_XXXXXX]

 

  1. Run the following commands on the collector to fix permissions.

 

chmod -R 775 /opt/phoenix/cache/parser/upload/http/
chown -R admin:admin /opt/phoenix/cache/parser/upload/http/

  1. Events should now be visible in FortiSIEM Analytics.

Contact Fortinet Support if the issue persists.
Terms & ConditionsAccessibility statement