FortiSIEM
FortiSIEM provides Security Information and Event Management (SIEM) and User and Entity Behavior Analytics (UEBA)
mbenvenuti
Staff
Staff
Article Id 351083
Description This article describes how to fix a 256 error code that occurs during a collector upgrade.
Scope FortiSIEM.
Solution

After a collector upgrade, the collector version remains unchanged and errors are present in the /opt/phoenix/log/collector-upgrade.log .

This has been noticed on collector upgrades to 7.X.X versions.

To fix this, follow the next steps:

 

  1. Visualize the error on the collector CLI as root:

From the /opt/phoenix/log/collector-upgrade.log file or after a manual installation with /usr/bin/python /opt/phoenix/phscripts/bin/phcollectorimageinstaller.py FortiSIEM |tee -a /opt/phoenix/log/collector-upgrade.log, lines like the following should be observed:

...

[PH_MODULE_EXIT_OK]:[eventSeverity]=PHL_INFO,[procName]=phtools,[fileName]=phBaseProcess.cpp,[lineNumber]=391,[phLogDetail]=Module exited gracefully
Traceback (most recent call last):
File "/usr/local/bin/configureFSM.py", line 16, in <module>
from syslib.common.utils import utils
File "/usr/local/syslib/common/utils.py", line 16, in <module>
import psycopg2
ModuleNotFoundError: No module named 'psycopg2'

...

configureFSM.py returns 256

 

This means that python3.9 packages are missing.

 

  1. Check python3.9 packages 

pip3.9 list | grep psycopg

pip3.9 list | wc -l

 

If commands are not reporting the psycopg package or the 0 package is present, the following steps are required.

 

  1. Package installation

Install requirements from the upgrade archive:

 

cd /opt/upgrade

rpm2cpio FSM_Upgrade_All_7.*/FortiSIEM-7.*/FortiSIEM-7.*.rpm | cpio -iv --to-stdout ./opt/phoenix/requirements-3.9.txt > /tmp/requirements-3.9.txt

./opt/phoenix/requirements-3.9.txt
13372320 blocks

pip3.9 install -r /tmp/requirements-3.9.txt

 

To confirm the installation succeeded, renew the 'Check python3.9 packages' steps where the psycopg package should be listed, along with around 181 packages.

 

Now, the collector upgrade will be possible to process again.

 

Contributors