Technical Tip: How to remove an old supervisor from a FortiSIEM collector

[alaxkar]

Description	This article describes how to remove an old supervisor from a FortiSIEM collector.
Scope	FortiSIEM.
Solution	To remove the old supervisor from the collector, first disassociate the Old Supervisor from the Collector: Remove the collector from the GUI (Old Supervisor). Check the PostgreSQL database to verify that the collector has been removed: psql -U phoenix phoenixdb select * from ph_sys_collector; server \q Remove the license from the collector: cd /etc/opsd ls –la rm –f <----- Insert the file that is there - either .phoenixXXXXXX or .fortisiemXXX. reboot now Add the collector in the GUI via the New Supervisor. Register the collector using the following command: phProvisionCollector --add <Organization-user-name> <Organization-user-password> <Supervisor-IP> <Organization-name> <Collector-name> After the registration is complete, the collector should restart automatically. Check the PostgreSQL database to see if the collector has been assigned a Natural ID. psql -U phoenix phoenixdb select * from ph_sys_collector; \q Check the GUI/collector health.