Description | This article describes how to troubleshoot the Email Incident Delay issue in FortiSIEM. |
Scope | FortiSIEM v6.x+. |
Solution |
When experiencing email incident delay, observe and verify it through the logs below:
Appsvr server logs:
[2024-03-05T10:00:41.323+0800] [glassfish 5.1] [SEVERE] [] [com.ph.phoenix.framework.logging.PhLogger] [tid: _ThreadID=8684 _ThreadName=p: thread-pool-1; w: 37] [timeMillis: 1709604041323] [levelValue: 1000] [[
Appsvr phoenix.log:
2024-02-23 11:56:05,954 [p: thread-pool-1; w: 23] ERROR com.ph.phoenix.service.notify.NotificationRequest - [PH_APPSERVER_NOTIFIER_ERROR]:[phCustId]=1,[eventSeverity]=PHL_ERROR,[phEventCategory]=3,[methodName]=_allocateConnection,[className]=com.sun.messaging.jms.ra.DirectConnectionFactory,[procName]=AppServer,[lineNumber]=509,[errReason]=MQRA:DCF:allocation failure:createConnection:Error in allocating a connection. Cause: javax.transaction.RollbackException,[phLogDetail]=Error happening while sending report via email
Below are the steps to fix the issue:
SSH to the supervisor root and update the connection limit:
cp /opt/glassfish/domains/domain1/config/domain.xml /opt/glassfish/domains/domain1/config/domain.xml_bak
Identify the following lines:
<connector-connection-pool max-pool-size="100" resource-adapter-name="jmsra" name="jms/ConnectionFactory" connection-definition-name="javax.jms.ConnectionFactory"></connector-connection-pool>
Replace them with the following:
After, save the file with :wq!.
kill -9 $(cat /opt/glassfish/domains/domain1/config/pid)
Wait for 5 to 10 minutes until the appserver comes up. If the issue persists, it must mean the issue is specific to the environment. A support engineer can help via the support platform. |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.