Troubleshooting Tip: FortiSIEM dropping rule does not work

[nsoni]

Description	This article describes how to fix an issue with FortiSIEM where the dropping rule to drop unwanted events does not work despite being configured correctly.
Scope	FortiSIEM.
Solution	Restart the phParser process on the Supervisor or collector as per the configuration to receive events. Log in to the CLI using SSH and switch to the 'admin' user: su admin Stop the phParser process: phtools --stop phParser Verify the phParser is down: phstatus Start the phParser process: phtools --start phParser Verify phParser is up: phstatus