Description
This article provides a method to fix the FortiSIEM Appserver maxNumMsgs error.
Scope
FortiSIEM.
Solution
Occasionally, users may encounter GUI slowness and incident display issues. It is highly related to Appserver performance and needs further analysis from the logs:
# /opt/glassfish/domains/domain1/logs/phoenix.log |grep -i error
If users notice an error below:
2025-10-24 11:23:55,004 [http-listener-3(5)] ERROR com.ph.phoenix.ws.rest.RestResource - [PH_APPSERVER_REST_ERROR]:[phCustId]=1,[eventSeverity]=PHL_ERROR,[phEventCategory]=3,[procName]=AppServer,[className]=com.sun.messaging.jms.ra.DirectSession,[methodName]=_sendMessage,[lineNumber]=1602,[errReason]=MQJMSRA_DS4001: JMSServiceException on send message:sendMessage: Sending message failed. Connection ID: 6342081953174567680 Caused by:com.sun.messaging.jmq.jmsserver.util.BrokerException: [B4120]: Can not add message 686343-10.25.183.172(bd:57:2c:95:9f:f1)-1-1761328023001 to destination jms_RequestQueue [Queue]. The destination message count limit (maxNumMsgs) of 100000 has been reached.,[phLogDetail]=REST error
The solution below can be applied:
- To remove all temp files and restart Java, run the commands below:
# rm -f /opt/glassfish/domains/domain1/imq/instances/imqbroker/fs370/message/Qjms_RequestQueue/vrfile
# rm -f /opt/glassfish/domains/domain1/imq/instances/imqbroker/fs370/message/Qjms_AlertQueue/vrfile
# rm -f /opt/glassfish/domains/domain1/imq/instances/imqbroker/fs370/txnlog
# rm -f /opt/glassfish/domains/domain1/imq/instances/imqbroker/fs370/incompleteTxnStore/vrfile
- Clear the cache and restart Java:
# su admin
# cd /opt/glassfish/domains/domain1/
# rm -rf generated/
# rm -rf osgi-cache/
# kill -9 $(cat /opt/glassfish/domains/domain1/config/pid)
After 10, 15 minutes, the GUI will be restored, and users may monitor the GUI performance.
