Troubleshooting Tip: How to verify whether a parser update has been successfully applied in FortiSIEM

Description

This article describes how to verify that a parser update has been successfully applied in FortiSIEM and that the updated parser is being used to process incoming events.

Scope

FortiSIEM.

Solution

Step 1:

Verify that the parser XML file has been updated on the Supervisor.

Example:

ls -l /opt/phoenix/config/eventParser/

Or:

find /opt/phoenix/config/eventParser -name "*<parser_name>*"

Step 2:

Verify the parser timestamp.

stat <parser_file.xml>

Compare the modification time with the time the parser was imported.

Step 3: 

Verify that the parser service has reloaded the updated parser.

Check:

tail -100 /opt/phoenix/log/phoenix.log

Look for messages indicating parser loading or compilation.

Step 4:

Run a Parser Test from the GUI using a recent raw event.

Confirm that:

• Parser Name is correct.

• Event Type is correct.

• Fields are extracted correctly.

Step 5:

Verify incoming events. Navigate to Analytics -> Raw Events. Confirm that new incoming events are using the updated parser.

Step 6:

Compare old and new events.

Check whether:

• New fields are populated.

• Event Type has changed.

• Parsing errors are no longer present.

Step 7:

If changes are not reflected:

Check:

• The parser was imported successfully.

• The parser was enabled.

• The parser was assigned to the correct Device Type.

• Supervisor services were restarted if required.

• Collectors were synchronized.

Verification:

The parser update is considered successful when:

• Parser Test returns the expected results.

• Newly received events use the updated parser.

• Required fields are extracted correctly.

• No parsing errors are observed in phoenix.log.