FortiSIEM
FortiSIEM provides Security Information and Event Management (SIEM) and User and Entity Behavior Analytics (UEBA)
premchanderr
Staff & Editor
Staff & Editor
Article Id 403191
Description This article describes steps to fix a FortiSIEM GUI warning message, 'Licensed Supervisor is down'
Scope ForitSIEM v7.3+.
Solution

While accessing the FortiSIEM GUI, the warning message appears: 


Sample Screenshot:

 

Licensed_Supervisor_down.png

 

Though there are no supervisors down in a High Availability environment, the message persists. 

The error occurs when etcd in super licensed is down. So other node can't get its IP Address while checking the license file.
The probable cause could be a license upload/sync failure or high utilization of the Application server, or network misconfiguration.

 

Backend Log error:

 

cat /opt/phoenix/log/phoenix.log | grep -i license

 phMonitorSupervisor[3955]: [PH_MONITOR_QUERY_LICENSE_FAILED]:[eventSeverity]=PHL_ERROR,[procName]=phMonitorSupervisor,[fileName]=phMonitorProcess.cpp,[lineNumber]=12331,[errorString]=Can't contact Licensed Super. Please start the Licensed Super.,[phLogDetail]=Follower Super query license failed

 

To resolve this error, follow the steps below:

  1. Validate if all details (IP Address, Hostname, etc) are correct in FortiSIEM Supervisor Nodes Cloud Health and License -> Nodes
    If any node has incorrect details, then first rectify by re-running configFSM.sh in Super CLI.
  2. Clear Application Server Cache and Restart Java 
  3. Re-upload the License File by logging in private Chrome/Firefox browser.