FortiSIEM

[Saleh_Mostafa]

I Was implemented FortiSIEM super with collector but now it seems to me in the health collector warning then become critical found all the services down then restart all the services works fine but the phAgentManager restart then down and restart then down. I want to solve this and why or what cause this down  

[premchanderr]

Hi @Saleh_Mostafa ,

phAgentManager would be high if any device integration in Admin > Setup > Pull Events has surplus of Events or events with large length.  You can test by disabling pull events for few recently added devices and then gradually enable to find root cause.

Also check for error in collector:

# cat /opt/phoenix/log/phoenix.log | grep -i phAgent