FortiSIEM provides Security Information and Event Management (SIEM) and User and Entity Behavior Analytics (UEBA)
Article Id 300968

This article describes some situations where FortiSiem wrongly maps the Collector type value. Specifically, FortiSiem is recognizing a 500F hardware collector as a VM Collector type.


Unregistering/re-registering the collector does not solve the problem. Even if possessing a lot of 500F collectors, the issue can happen only for a few units. It is not a general anomaly.



Scope FortiSIEM v7.x MSSP deployment.

Since the Collector Type value is used for description purposes only, it is possible to change the value manually from the PostgreSQL console. Access Supervisor CLI and run the following command:


  1. Access to PostgreSQL console:

     psql -U phoenix phoenixdb


Run the following command:

update ph_sys_collector set collector_type = '<value>' where name='<collector-name>';


Available values for collector_type are:

  • VM.
  • 1 Hardware.
  • 2 Docker.

The collector-name can be retrieved from GUI from Admin -> Health Check -> Collector Health tab.

A command example would be then:

update ph_sys_collector set collector_type = '1' where name='collector1';


A UPDATE=1 message should be displayed after sending the command.



  1. Verify if the Collector Type has changed. So, access again to GUI and then to Admin -> Health Check -> Collector Health tab.