FortiSIEM Collector Buffer Filling Up – Collector Uploading to Its Own IP Hello, In our FortiSIEM environment, we are receiving the following health warning:---> Event Pipeline: Warning (Collector Buffer between 20MB and 50MB) After checking the logs, I observed that the collector is trying to upload events to a worker, and the destination IP is the collector’s own IP address. However, we are not using any workers in this deployment – only a Supervisor and a Collector. Because of this, the collector keeps sending HTTP requests to itself, receives a failed response, and then writes the events into:" /opt/phoenix/cache/parser/events/ " This continuously increases the collector buffer size. As a temporary workaround, I manually delete the .dat files in that directory, which clears the warning, but the issue reappears after a short while because the collector continues to target its own IP. What would be the correct permanent solution for this issue? Best Regards,İsmail Ürek
