Failed to upload event file to worker

[Ali_Maher]

Hello FortiSIEMer,

Hope u have a great day!

We notice that we didn't receive any logs on the supervisor from the endpoints, then we tail the phoenix logs :

2024-07-21T02:24:12.306312+03:00 collector phEventPackager[7946]: [PH_EVT_PACKAGER_FILE_UPLOAD_FAILURE]:[eventSeverity]=PHL_WARNING,[procName]=phEventPackager,[fileName]=phEventPKGProcess.cpp,[lineNumber]=1013,[filePath]=/opt/phoenix/cache/parser/events/evt_1721500592_13_73.dat,[errorNoInt]=401,[destName]=super.barq.local,[phLogDetail]=Failed to upload event file to worker

2024-07-21T02:25:13.317998+03:00 collector phEventPackager[7946]: [PH_EVT_PACKAGER_FILE_UPLOAD_FAILURE]:[eventSeverity]=PHL_WARNING,[procName]=phEventPackager,[fileName]=phEventPKGProcess.cpp,[lineNumber]=1013,[filePath]=/opt/phoenix/cache/parser/events/evt_1721500586_32_72.dat,[errorNoInt]=401,[destName]=worker.barq.local,[phLogDetail]=Failed to upload event file to worker

[Ali_Maher]

The Collector can upload event file Now:

From here [errorNoInt]=401, we found that the error refer to 401 Unauthorized Error Response from Collector to Supervisor and we registered it again, and works fine now.

[Jackli]

i have the same issue,but my error code is 500,what is the problem? i can't to resolve.

[Goutham_FTNT]

Error 500 is server busy 
This could be because the worker upload node is busy 

[Jackli]

OK,Thanks you!

Goutham,Let me ask again, will the size of the EPS cause the data to fail to upload to NFS at all?

[premchanderr · Accepted solution]

Hi Ali,

The  Event packager and phParser are also throwing a 401 error > Not authorized. Try re-registering the collector.

If issue still persists:

1 - As a workaround please add a new User to the ORG with Full Admin rights and re-provision the Collector using the newly created username.
2- Check on your GUI to make sure their are no Accounts that are locked out > top right corner of the GUI > The person ICON > Locked Users

[AliMhaerFathy]

Re-register the collector again makes it working fine

[premchanderr]

@AliMhaerFathy  Glad issue has been resolved.