Technical Tip: How to replace a Collector node in FortiSIEM

[aldodelgadomtz]

Description	This article describes the simplest way to replace a Collector node.
Scope	FortiSIEM.
Solution	Follow the KDB in question to create a new Collector from scratch: Fresh Installation. If having Windows/Linux agents, back up the following file locally: ll /etc/httpd/accounts/passwds Once reinstalled, copy the previous file with the following commands: chown -R root.root /etc/httpd/accounts/passwds chmod -R 775 /etc/httpd/accounts/passwds Provision the new Collector as follows: Usage: phProvisionCollector --update <Organization-user-name> <Organization-user-password> <Supervisor-IP/FQDN> <Organization-name> <Collector-name> For examples: - Enterprise mode, use admin/password and the org name is super, the collector name is Col01 phProvisionCollector --update admin password <Super IP or Host> super Col01 - Service Provider mode, with Organisation=CustA and its collector is Col01 phProvisionCollector --update Org_admin Org_password <Super IP/FQDN> CustA Col01 Note: It is not necessary to delete any configuration from the Supervisor's GUI.