- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Failed to upload event file to worker
Hello FortiSIEMer,
Hope u have a great day!
We notice that we didn't receive any logs on the supervisor from the endpoints, then we tail the phoenix logs :
2024-07-21T02:24:12.306312+03:00 collector phEventPackager[7946]: [PH_EVT_PACKAGER_FILE_UPLOAD_FAILURE]:[eventSeverity]=PHL_WARNING,[procName]=phEventPackager,[fileName]=phEventPKGProcess.cpp,[lineNumber]=1013,[filePath]=/opt/phoenix/cache/parser/events/evt_1721500592_13_73.dat,[errorNoInt]=401,[destName]=super.barq.local,[phLogDetail]=Failed to upload event file to worker
2024-07-21T02:25:13.317998+03:00 collector phEventPackager[7946]: [PH_EVT_PACKAGER_FILE_UPLOAD_FAILURE]:[eventSeverity]=PHL_WARNING,[procName]=phEventPackager,[fileName]=phEventPKGProcess.cpp,[lineNumber]=1013,[filePath]=/opt/phoenix/cache/parser/events/evt_1721500586_32_72.dat,[errorNoInt]=401,[destName]=worker.barq.local,[phLogDetail]=Failed to upload event file to worker
Solved! Go to Solution.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi Ali,
The Event packager and phParser are also throwing a 401 error > Not authorized. Try re-registering the collector.
If issue still persists:
1 - As a workaround please add a new User to the ORG with Full Admin rights and re-provision the Collector using the newly created username.
2- Check on your GUI to make sure their are no Accounts that are locked out > top right corner of the GUI > The person ICON > Locked Users
Prem Chander R
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The Collector can upload event file Now:
From here [errorNoInt]=401, we found that the error refer to 401 Unauthorized Error Response from Collector to Supervisor and we registered it again, and works fine now.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
i have the same issue,but my error code is 500,what is the problem? i can't to resolve.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Error 500 is server busy
This could be because the worker upload node is busy
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
OK,Thanks you!
Goutham,Let me ask again, will the size of the EPS cause the data to fail to upload to NFS at all?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi Ali,
The Event packager and phParser are also throwing a 401 error > Not authorized. Try re-registering the collector.
If issue still persists:
1 - As a workaround please add a new User to the ORG with Full Admin rights and re-provision the Collector using the newly created username.
2- Check on your GUI to make sure their are no Accounts that are locked out > top right corner of the GUI > The person ICON > Locked Users
Prem Chander R
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Re-register the collector again makes it working fine
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@AliMhaerFathy Glad issue has been resolved.
Prem Chander R