FortiSIEM AIO - Collector questions and WMI/OMI issues

[Thonno]

Hi everyone,

I'm setting up a FortiSIEM Supervisor All-in-one (AIO) with version 7.2.0, but I've encountered an issue with the Collector.

When I go to Admin → Setup → Collector, there is no option to configure the Collector’s IP or designate the server as a Collector. It seems like the Collector role is not enabled by default in my AIO environment. I also checked using systemctl, and the phCollector service does not exist on the system.

Steps I’ve already taken:

1. I checked the /opt/phoenix/config/phoenix_config.txt file to verify if the Collector role is enabled, but it seems unrecognized.
2. Tried to find and start the Collector service, but the system says it doesn't exist.
3. Restarted the main FortiSIEM services (phoenix), but the issue persists.

I need to monitor events from Windows servers, but I'm encountering issues with WMI/OMI. I'm receiving errors such as "WMI failed (Login to remote object error)" and "OMI failed (Win32_OperatingSystem Result not found via OMI)", even though everything is enabled on the Windows machines.

Without the Collector, I cannot add the template for the Windows agent I've created.

Has anyone experienced something similar or knows how to properly configure the All-in-one server as a Collector? Do I need to install an additional package or run a specific command?

Thanks in advance for your help!

[premchanderr]

Hi @Thonno ,

To view Admin → Setup → Collector you would need to be in Super>Local Scope.

I guess you are in Super>Global scope and your box is deployed as service provider license. This case do you see  Admin → Setup → Organizations ?

[Thonno]

Hi, I am in

• Organization: Super
• User: admin
• Scope: Local

I actually don’t see Admin / Setup / Organizations.

I see the Collector option under Admin / Setup; I tried to create a collector, but the problem is that I have an AIO environment, and I don’t have any additional VMs/servers with roles adjacent to the Supervisor.

After creating the collector, I see the error "No Connection" under Admin / Health / Collector Health because I don’t have any other servers.

I have only the AIO Enterprise license.

[premchanderr · Accepted solution]

Hi @Thonno ,

Yes in local scope only collector would be visible.  In Enterprise license you can add  any number of collectors. 

Collector is separate VM , there is no other option and you need to deploy a new VM. 
Post that can register the collector to supervisor. 

Documentation:

https://docs.fortinet.com/document/fortisiem/7.2.3/esx-installation-guide/131018/fresh-installation#...

[leonardheroiu]

Hello

Did you found a workaround or a resolution?

[Thonno]

Hi, I finally solved it by configuring the credentials in OMI with kerberos-auth instead of ntlm-auth, and it worked. In WMI or OMI, ntlm has always given me issues. I ended up not using the Agent because, after reviewing the licenses, I realized I only had 2 agents available for installation.