Hello,
In our FortiSIEM environment, we are receiving the following health warning:
---> Event Pipeline: Warning (Collector Buffer between 20MB and 50MB)
After checking the logs, I observed that the collector is trying to upload events to a worker, and the destination IP is the collector’s own IP address. However, we are not using any workers in this deployment – only a Supervisor and a Collector.
Because of this, the collector keeps sending HTTP requests to itself, receives a failed response, and then writes the events into:
" /opt/phoenix/cache/parser/events/ "
This continuously increases the collector buffer size.
As a temporary workaround, I manually delete the .dat files in that directory, which clears the warning, but the issue reappears after a short while because the collector continues to target its own IP.
What would be the correct permanent solution for this issue?
Best Regards,
İsmail Ürek
