Skip to main content
nsoni
Staff
Staff
August 14, 2026

Troubleshooting Tip: PH_REPORT_SQLITE3_PROFILE_NOT_FOUND errors due to invalid baseline profile IDs defined in rules

  • August 14, 2026
  • 0 replies
  • 49 views

Description

This article describes how to identify and resolve recurring PH_REPORT_SQLITE3_PROFILE_NOT_FOUND errors caused by rules referencing invalid baseline profile IDs.

Scope

FortiSIEM.

Solution

Symptoms:

The following error is repeatedly logged in /opt/phoenix/log/phoenix.log.


For example:

2026-01-11T10:00:02.169469+05:30 lab1 phRuleMaster[eventSeverity]=PHL_ERROR,[procName]=phRuleMaster,[fileName]=ProfileDBHandler.cpp,[lineNumber]=601,[dbName]=/opt/phoenix/cache/profile.db,[reportId]=30,[phLogDetail]=Profile ID not found in SQLite3


Cause:

The rule references a profile ID that is not present in the profile database.

Valid profile IDs are defined in:

/opt/phoenix/data-definition/profile/ProfileReports.xml


Only profile IDs 104 through 130 are supported. Any rule referencing a profile ID outside this range may generate the following error:

PH_REPORT_SQLITE3_PROFILE_NOT_FOUND


Solution:

Identify the invalid profile ID from the [reportId]= field in the log message.

Example:

[reportId]=30


In this example, profile ID 30 is invalid.


Method 1: Identify the rule from the CLI.

Run the following PostgreSQL query, replacing the profile ID as needed:

psql -U phoenix phoenixdb -c "select name, active, cust_org_id, creation_type, removed from ph_drq_rule where active='t' and rule_xml like '%):30)%';"


Note: Replace 30 with the reportId reported in the error message.


Method 2: Identify the rule from the GUI.

  1. Navigate to CMDB Search.

  2. Apply the filter:


Filter Group Constraint CONTAIN :30


Note: Replace 30 with the reportId reported in the error message.

After identifying the affected rule(s):

  • Remove the invalid profile ID reference from the rule configuration, or:

  • Disable the rule if it is no longer required.


Once all active rules referencing invalid profile IDs have been corrected or disabled, the PH_REPORT_SQLITE3_PROFILE_NOT_FOUND errors should stop appearing in /opt/phoenix/log/phoenix.log.

Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
Virtual event | September 2026. SASE summit. The age of autonomous trust. Register here!