FortiSIEM
FortiSIEM provides Security Information and Event Management (SIEM) and User and Entity Behavior Analytics (UEBA)
calvinc97
Staff
Staff
Article Id 304926
Description This article describes how to troubleshoot the Email Incident Delay issue in FortiSIEM.
Scope FortiSIEM v6.x+.
Solution

When experiencing email incident delay, observe and verify it through the logs below:

 

Appsvr server logs:

 

[2024-03-05T10:00:41.323+0800] [glassfish 5.1] [SEVERE] [] [com.ph.phoenix.framework.logging.PhLogger] [tid: _ThreadID=8684 _ThreadName=p: thread-pool-1; w: 37] [timeMillis: 1709604041323] [levelValue: 1000] [[
MQRA:DCF:allocation failure:createConnection:Error in allocating a connection. Cause: javax.transaction.RollbackException
com.sun.messaging.jms.JMSException: MQRA:DCF:allocation failure:createConnection:Error in allocating a connection. Cause: javax.transaction.RollbackException

Caused by: javax.resource.spi.ResourceAllocationException: Error in allocating a connection. Cause: javax.transaction.RollbackException

 

Appsvr phoenix.log:

 

2024-02-23 11:56:05,954 [p: thread-pool-1; w: 23] ERROR com.ph.phoenix.service.notify.NotificationRequest - [PH_APPSERVER_NOTIFIER_ERROR]:[phCustId]=1,[eventSeverity]=PHL_ERROR,[phEventCategory]=3,[methodName]=_allocateConnection,[className]=com.sun.messaging.jms.ra.DirectConnectionFactory,[procName]=AppServer,[lineNumber]=509,[errReason]=MQRA:DCF:allocation failure:createConnection:Error in allocating a connection. Cause: javax.transaction.RollbackException,[phLogDetail]=Error happening while sending report via email

 

Below are the steps to fix the issue:

 

SSH to the supervisor root and update the connection limit:

 

cp /opt/glassfish/domains/domain1/config/domain.xml /opt/glassfish/domains/domain1/config/domain.xml_bak
vi /opt/glassfish/domains/domain1/config/domain.xml

 

Identify the following lines:

 

<connector-connection-pool max-pool-size="100" resource-adapter-name="jmsra" name="jms/ConnectionFactory" connection-definition-name="javax.jms.ConnectionFactory"></connector-connection-pool>
<connector-connection-pool max-pool-size="400" resource-adapter-name="jmsra" name="jms/NotificationConnectionFactory" connection-definition-name="javax.jms.ConnectionFactory"></connector-connection-pool>

 

Replace them with the following:


<connector-connection-pool max-pool-size="200" resource-adapter-name="jmsra" name="jms/ConnectionFactory" connection-definition-name="javax.jms.ConnectionFactory"></connector-connection-pool>
<connector-connection-pool max-pool-size="800" resource-adapter-name="jmsra" name="jms/NotificationConnectionFactory" connection-definition-name="javax.jms.ConnectionFactory"></connector-connection-pool>

 

After, save the file with :wq!.

Restart the appserver:

 

kill -9 $(cat /opt/glassfish/domains/domain1/config/pid)

 

Wait for 5 to 10 minutes until the appserver comes up. If the issue persists, it must mean the issue is specific to the environment. A support engineer can help via the support platform.

Contributors