Skip to main content
koolishami
Staff
koolishami
Staff
May 14, 2026

Troubleshooting Tip: FortiSIEM SNMP monitoring not scheduled despite successful discovery

  • May 14, 2026
  • 0 replies
  • 23 views

Description


This article describes an issue in FortiSIEM where SNMP device discovery and credential test connectivity complete successfully, but performance monitoring fails to start.


Scope


FortiSIEM 7.X+.


Solution


The following are the symptoms of the issue:

  • Test Connectivity completes successfully

  • In Admin -> Setup -> Monitor Performance, ping monitor shows a Warning icon and hovering over the icon shows 'Execution Failed: host unreachable'.

  • SNMP monitors show a 'Pause' icon and hovering over the icon shows 'Not Scheduled: Missing/Invalid SNMP credential'.

  • /opt/phoenix/log/phoenix.log shows the following errors (excerpt from the logs):


2026-03-03 16:03:50,089 [pool-16-thread-91801] INFO com.ph.phoenix.framework.logging.PhAudit - [PH_AUDIT_DEV_MON_JOB_STATUS_CHANGE]:[eventSeverity]=PHL_INFO,[phEventCategory]=2,[procName]=AppServer,[user]=SYSTEM(su),[jobStatusType]=DiscoveryAdded,[jobName]=ICMP Ping Status,[appTransportProto]=PING,[pullInteval]=120,[hostIpAddr]=X.X.X.X,[hostName]=HOSTNAME,[custId]=2002,[customer]=ORGNAME,[phCustId]=1,[phLogDetail]=Monitor on device was added

2026-03-03 16:03:50,092 [pool-16-thread-91801] INFO com.ph.phoenix.framework.logging.PhAudit - [PH_AUDIT_DEV_MON_JOB_STATUS_CHANGE]:[eventSeverity]=PHL_INFO,[phEventCategory]=2,[procName]=AppServer,[user]=SYSTEM(su),[jobStatusType]=DiscoveryAdded,[jobName]=SNMP Ping Status,[appTransportProto]=SNMP,[pullInteval]=120,[hostIpAddr]=X.X.X.X,[hostName]=HOSTNAME,[custId]=2002,[customer]=ORGNAME,[phCustId]=1,[phLogDetail]=Monitor on device was added

2026-03-03 16:03:50,096 [pool-16-thread-91801] INFO com.ph.phoenix.framework.logging.PhAudit - [PH_AUDIT_DEV_MON_JOB_STATUS_CHANGE]:[eventSeverity]=PHL_INFO,[phEventCategory]=2,[procName]=AppServer,[user]=SYSTEM(su),[jobStatusType]=DiscoveryAdded,[jobName]=Device uptime,[appTransportProto]=SNMP,[pullInteval]=60,[hostIpAddr]=X.X.X.X,[hostName]=HOSTNAME,[custId]=2002,[customer]=ORGNAME,[phCustId]=1,[phLogDetail]=Monitor on device was added


In the logs above, custId=2002, which means that the SNMP logs are being sent to the Collector that belongs to the 2002 organization while the SNMP credentials belong to the Super organization (phCustId=1).


This strongly suggests:

  • The device belongs to Org 2002.

  • SNMP credentials may exist under Org 1 (Super).


FortiSIEM cannot use the credentials, which is why monitoring is not scheduled. To fix this:

  1. Select the arrow icon on the top right of the GUI.

  2. Navigate to Change Organization View -> Switch to Organization -> In the dropdown menu, select the correct organization.

  3. Navigate to Admin -> Setup -> Credentials.

  4. Recreate the SNMP Credentials in this view.

    Terms & ConditionsAccessibility statement