Skip to main content
kdave
Staff
Staff
February 25, 2025

Troubleshooting Tip: How to resolve Collector Event Upload errors with Self-signed Certificates installed on Workers

  • February 25, 2025
  • 0 replies
  • 1253 views
Description This article describes How to resolve Collector Event Upload errors with Self-signed Certificates installed on Workers.
Scope FortiSIEM.
Solution

The symptoms of this issue are observed in collector backend Phoenix logs as below.

 

tail -f /opt/phoenix/log/phoenix.log

 

2025-01-26T20:04:09.027498+05:30 FSM_Collector phEventPackager[34422]: [PH_HTTP_RESPONSE_FAILURE]:[eventSeverity]=PHL_WARNING,[procName]=phEventPackager,[fileName]=phHttpClient.cpp,[lineNumber]=609,[errorNo]=0,[phLogDetail]=HTTP response code failure
2025-01-26T20:04:09.099344+05:30 FSM_Collector phEventPackager[3607]: [PH_EVT_PACKAGER_FILE_UPLOAD_FAILURE]:[eventSeverity]=PHL_WARNING,[procName]=phEventPackager,[fileName]=phEventPKGProcess.cpp,[lineNumber]=1008,[filePath]=/opt/phoenix/cache/parser/events/evt_1731583984_2_21075.dat,[errorNoInt]=0,[destName]=WORKERFQDN,[phLogDetail]=Failed to upload event file to worker

 

The below-mentioned steps can be followed to resolve such an issue:

  • Verify on Collector/etc/hosts entries are correct for Supervisor, Worker FQDNs
  • Check if Self Signed Certificates are used in the Environment.
  • In case Self-signed certificates are being used, the following entry in /opt/phoenix/config/phoenix_config.txt needs to be adjusted. 

 

http_client_verify_peer=no

 

  • Also, the/opt/phoenix/config/collector_config_template.txt file on the Supervisor needs to be corrected such that the change is consistent across all new collectors.


http_client_verify_peer=no

 

  • Check again in the backend Phoenix logs of the collector and verify if the collector upload buffer gets cleared in GUI from Admin -> Health -> Collector Health.

 

Related article:

Troubleshooting Tip: How to troubleshoot collector issues

Thought Leadership. Security Summit. Thursday, November 12th, PGA National Resort, Palm Beach Gardens, FL.
Thought Leadership. Security Summit. Thursday, October 8th. Disney's Grand Californian Hotel & SPA, Anaheim, CA.
Security Operations Summit: Modernize SecOps. Operate AI-Native.AMER: November 4 | 9:00 AM PST. India and SAARC: November 5 | 10:00 AM IST. EMEA: November 5 | 10:30 AM CET. APAC: November 5 | 11:00 AM SGT