FortiSIEM Discussions
mscirri
New Contributor II

Unable to stop processes with phTools

I was trying to stop and start all processes in an attempt to get the latest content update to install. Every time we try to install it the status just sits  at "Installing" with no progress bar updates into perpetuity.   So I thought I would try restarting the processes.   When I log in as root and run phtools --stop ALL it fails. Below is a snippet of the output that contains errors.

 

Version 6.7.0.1716

Content Version Running:  407

 

[PH_MODULE_LOG_LEVEL_CHANGE]:[eventSeverity]=PHL_INFO,[procName]=phtools,[fileName]=phBaseProcess.cpp,[lineNumber]=682,[oldLogLevel]=424,[newLogLevel]=424,[phLogDetail]=Module received log level change
[PH_UTIL_PHOENIX_CONFIG_ITEM_MISSING]:[eventSeverity]=PHL_ERROR,[procName]=phtools,[fileName]=phConfigurations.cpp,[lineNumber]=157,[propName]=phtools,[phLogDetail]=Could not find item in phoenix_config.txt
[PH_MODULE_INIT_COMPLETE]:[eventSeverity]=PHL_INFO,[procName]=phtools,[fileName]=phBaseProcess.cpp,[lineNumber]=563,[phLogDetail]=Module successfully started
[PH_NOTIFICATION_CONN_FAILED]:[eventSeverity]=PHL_ERROR,[procName]=phtools,[fileName]=phBaseNotificationClient.cpp,[lineNumber]=103,[serverName]=localhost,[ipPort]=17900,[module]=phMonitor,[phLogDetail]=Failed to connect to notification server - localhost:17900
Monitor is not available
[PH_MODULE_EXIT_OK]:[eventSeverity]=PHL_INFO,[procName]=phtools,[fileName]=phBaseProcess.cpp,[lineNumber]=367,[phLogDetail]=Module exited gracefully

 

FortiSIEM 

4 REPLIES 4
mscirri
New Contributor II

I restarted the whole VM and everything works fine now. Go figure.

premchanderr
Staff
Staff

Hi @mscirri ,

 

These log messages are generic , the restart of processed would take time if anything is highly utilized. In that case you can find the pid and kill it. 

Also to restart all the processes, not just phProcess . You can use below command:
# phxctl stop

# phxctl start
# phxctl reboot

Regards,
Prem Chander R
mscirri

So I would do all 3?   Or does reboot = stop + start?

premchanderr

Hi @mscirri , 

Phxctl Reboot will systematically stop and start processes. Or you can use just stop and then start too. 

Regards,
Prem Chander R