FortiSIEM Discussions
JohnCheong
New Contributor II

Collector Health: Event Pipeline: Critical (Collector Buffer greater than 50MB)

Hi,

 

Would like to ask how can I solve this error ya?

1.jpg
Thanks.
John-

1 REPLY 1
Goutham_FTNT
Staff
Staff

Hi John,

 

Collector buffer more => 50M could be because of slow writes to the storage

You can further check if the storage disk can write properly to the disk

For eventdb you can use iostat or nfsiostat to check the i/o of the disks

 

Also you can check the backend logs on Super/workers/collectors and look for errors to see if there are any write errors on Super/Worker and upload errors on collector 

 

/opt/phoenix/log/phoenix.log