This article describes how to troubleshoot the 'Connection Refused' error in FortiSIEM GUI > Analytics search
Scope
FortiSIEM v6.x+.
Solution
When running a search in analytics it immediately fails with a 'Connection Refused' error even for small time intervals.
This would occur if storage is not mounted or storage-related configuration is incorrect.
Here are a few checks to fix this issue:
Validate if correct values are displayed in FortiSIEM GUI -> Admin -> Setup -> Storage.
In the backend check if storage is mounted, enough free space, and permissions are admin.admin:
# df -h
# ls -lah /data/eventdb/
Note down the FQDN value of super from the health tab. Run #configFSM.sh to re-run with the same or correct network configuration. Do note this requires a reboot of the system.
It is possible now to perform a search and view events in FortiSIEM GUI. If the issue persists, it is then specific to the environment and a support engineer can help via the support platform.
