Troubleshooting Tip: How to resolve the phAnomalyWorker continuously getting restarted on the worker after installation
| Description | This article describes how to resolve the phAnomalyWorker continuously getting restarted on the worker after installation. |
| Scope | FortiSIEM. |
| Solution | It has been observed that the phAnomalyWorker process continuously gets restarted on the worker after a fresh installation. The following errors have been observed in /opt/phoenix/log/phoenix.log of the worker.
2026-03-05T14:20:39.579803+05:30 Worker02 [PH_AUDIT_ML_GENERIC_CRITICAL]:[eventSeverity]=CRITICAL,[task_id]=main,[task_name]=main,[procDetails]={Frequent restarts detected: RestartFreqExceeded('5 in 1s')}#012Traceback (most recent call last):#012 File "celery/worker/consumer/consumer.py", line 330, in start#012 self._restart_state.step()#012 File "billiard/common.py", line 152, in step#012billiard.exceptions.RestartFreqExceeded: 5 in 1s
It means the worker is unable to reach the supervisor using the hostname dbleader.fsiem.fortinet.com.
Check the entry for host dbleader.fsiem.fortinet.com in the/etc/hosts file on the worker.
Make sure that dbleader.fsiem.fortinet.com is resolved to the Supervisor's IP and not the worker's IP.
Check if there are interruptions for communication due to the network from the worker to the supervisor node using hostname dbleader.fsiem.fortinet.com over TCP port 6666. |
