Technical Tip: How to replace a Worker node in FortiSIEM

[aldodelgadomtz]

Description	This article describes the simplest way to replace a Worker node.
Scope	FortiSIEM.
Solution	Before re-join a Worker, deploy a VM from scratch as follows: Fresh Installation. Be sure that the Worker is under the same release version from the Supervisor. Check the compatibility matrix: FortiSIEM Version Compatibility for Rocky Linux Based Releases. In case the behavior remains the same on the Worker, do the following: Follow the instructions in the KDB to remove the Worker correctly: Deleting Worker Node. Access the Supervisor node via CLI and execute the following command: cd /opt/phoenix rm -f .nfs.json Deploy a new Worker with 16 vCPU and 32 GB in RAM with the following KDB: Fresh Installation. Proceed to add the node again as follows: Adding a Worker Node. Finally, access via CLI to the Collector and execute the following commands in the strictly stipulated order: mv /etc/opsd/.fortisiem4x0 /var/tmp shutdown -r now phProvisionCollector --update admin <password> <super IP or host> Super <collectorName> Note: It is very important to re-add a Collector node because it is not able to update Worker information automatically.