Not Able to Delete the Collector from Fortisiem , Getting an Error

[anshulFlexis]

Hi,

I am not able to delete the collector from Fortisiem , Getting below error . Let me know how can i fix this.

Thanks,
Flexis

[premchanderr]

Hi Pradeep,

Could you review the steps from below article and let us know if issue resolves: :https://community.fortinet.com/t5/FortiSIEM/Techinical-Tip-FortiSIEM-Collector-Deletion-Error/ta-p/3...

[anshulFlexis]

Hi prem,

The steps you send is for different error. Still we i am getting this error after upgrading to new version 7.3.2 . Anything option to delete the old collector.

[Secusaurus]

Hi @anshulFlexis,

I assume, you did check that there is no object/credential/configuration linked to the collector anymore, correct?

• Is this a collector of an organization you are taking offline? Or is the org still online?
• Do you still have more collectors in that organization or would it be the last one?
• Did the collector have credentials/information that was applied to it or was it only receiving syslogs?
• Was an agent profile connected to it?

In general, the error shows that the collector is referenced somewhere in the database. So there is something in the backend that needs the information "do not use this collector" before removing it. All the questions above could be a hint where to look for these links.

If, for any reason, there is no clear connection you can draw, going through the database should be done with a TAC engineer (support ticket).

Best,

Christian