This article describes how to delete a collector from the CLI.
Scope
FortiSIEM Super.
Solution
It happens that the collector cannot be removed from the GUI because of dependency issues or timeouts. Here are the steps to follow from the super CLI as root to remove the collector from the database:
Requirements:
The collector is shut down, unregistered, or undeployed and will not send events to the FortiSIEM anymore.
Removal:
From Admin-> Health-> Collector, note down the collector ID to remove, then run the next commands from super CLI as root:
collector_id='12345' # replace the number by the collector ID psql -U phoenix phoenixdb -c "delete from ph_task where collector_id=${collector_id}" psql -U phoenix phoenixdb -c "delete from ph_collector_cpu where collector_status_id in (select id from ph_collector_status where collector_id='${collector_id}')" psql -U phoenix phoenixdb -c "delete from ph_collector_disk where collector_status_id in (select id from ph_collector_status where collector_id='${collector_id}')" psql -U phoenix phoenixdb -c "delete from ph_collector_disk_io where collector_status_id in (select id from ph_collector_status where collector_id='${collector_id}')" psql -U phoenix phoenixdb -c "delete from ph_collector_mem_swap where collector_status_id in (select id from ph_collector_status where collector_id='${collector_id}')" psql -U phoenix phoenixdb -c "delete from ph_collector_status where collector_id='${collector_id}'" psql -U phoenix phoenixdb -c "delete from ph_sys_collector where collector_id=${collector_id}"
The collector should not appear in the GUI anymore.
