Technical Tip: The 'Connection Refused' error in FortiSIEM GUI

[premchanderr]

Description	This article describes how to troubleshoot the 'Connection Refused' error in FortiSIEM GUI > Analytics search
Scope	FortiSIEM v6.x+.
Solution	When running a search in analytics it immediately fails with a 'Connection Refused' error even for small time intervals.  This would occur if storage is not mounted or storage-related configuration is incorrect.  Here are a few checks to fix this issue: Validate if correct values are displayed in FortiSIEM GUI -> Admin -> Setup -> Storage. In the backend check if storage is mounted, enough free space, and permissions are admin.admin: # df -h # ls -lah /data/eventdb/ Note: 'admin:admin' permissions only apply if the 'Event Database' is set on 'Local Event Database' or 'External NFS Database'. The FQDN value of super from the health tab. Run #configFSM.sh to re-run with the same or correct network configuration. Do note this requires a reboot of the system. Ensure /etc/hosts has the following lines: 127.0.0.1 localhost localhost.localdomain ::1 localhost localhost.localdomain Super-IP   Super-Hostname It is possible now to perform a search and view events in the FortiSIEM GUI.  If the issue persists, it is then specific to the environment, and a support engineer can help via the support platform