FortiSIEM Discussions
Ali_Maher
New Contributor III

Failed to upload event file to worker

Hello FortiSIEMer,

Hope u have a great day!

 

We notice that we didn't receive any logs on the supervisor from the endpoints, then we tail the phoenix logs :

 

2024-07-21T02:24:12.306312+03:00 collector phEventPackager[7946]: [PH_EVT_PACKAGER_FILE_UPLOAD_FAILURE]:[eventSeverity]=PHL_WARNING,[procName]=phEventPackager,[fileName]=phEventPKGProcess.cpp,[lineNumber]=1013,[filePath]=/opt/phoenix/cache/parser/events/evt_1721500592_13_73.dat,[errorNoInt]=401,[destName]=super.barq.local,[phLogDetail]=Failed to upload event file to worker


2024-07-21T02:25:13.317998+03:00 collector phEventPackager[7946]: [PH_EVT_PACKAGER_FILE_UPLOAD_FAILURE]:[eventSeverity]=PHL_WARNING,[procName]=phEventPackager,[fileName]=phEventPKGProcess.cpp,[lineNumber]=1013,[filePath]=/opt/phoenix/cache/parser/events/evt_1721500586_32_72.dat,[errorNoInt]=401,[destName]=worker.barq.local,[phLogDetail]=Failed to upload event file to worker

BR, Ali Maher
BR, Ali Maher
1 Solution
premchanderr
Staff
Staff

Hi Ali,

 

The  Event packager and phParser are also throwing a 401 error > Not authorized. Try re-registering the collector.


If issue still persists:

1 - As a workaround please add a new User to the ORG with Full Admin rights and re-provision the Collector using the newly created username.
2- Check on your GUI to make sure their are no Accounts that are locked out > top right corner of the GUI > The person ICON > Locked Users

Regards,
Prem Chander R

View solution in original post

7 REPLIES 7
Ali_Maher
New Contributor III

The Collector can upload event file Now:

From here [errorNoInt]=401, we found that the error refer to 401 Unauthorized Error Response from Collector to Supervisor and we registered it again, and works fine now.

BR, Ali Maher
BR, Ali Maher
Jackli
New Contributor

i have the same issue,but my error code is 500,what is the problem? i can't to resolve.

Goutham_FTNT

Error 500 is server busy 
This could be because the worker upload node is busy 

Jackli
New Contributor

OK,Thanks you!

Goutham,Let me ask again, will the size of the EPS cause the data to fail to upload to NFS at all?

premchanderr
Staff
Staff

Hi Ali,

 

The  Event packager and phParser are also throwing a 401 error > Not authorized. Try re-registering the collector.


If issue still persists:

1 - As a workaround please add a new User to the ORG with Full Admin rights and re-provision the Collector using the newly created username.
2- Check on your GUI to make sure their are no Accounts that are locked out > top right corner of the GUI > The person ICON > Locked Users

Regards,
Prem Chander R
AliMhaerFathy

Re-register the collector again makes it working fine

premchanderr
Staff
Staff

@AliMhaerFathy  Glad issue has been resolved. 

Regards,
Prem Chander R
Announcements

Welcome to your new Fortinet Community!

You'll find your previous forum posts under "Forums"