Troubleshooting Tip: How to resolve Collector Event Upload errors with Self-signed Certificates installed on Workers

[kdave]

Description	This article describes How to resolve Collector Event Upload errors with Self-signed Certificates installed on Workers.
Scope	FortiSIEM.
Solution	The symptoms of this issue are observed in collector backend Phoenix logs as below. tail -f /opt/phoenix/log/phoenix.log 2025-01-26T20:04:09.027498+05:30 FSM_Collector phEventPackager[34422]: [PH_HTTP_RESPONSE_FAILURE]:[eventSeverity]=PHL_WARNING,[procName]=phEventPackager,[fileName]=phHttpClient.cpp,[lineNumber]=609,[errorNo]=0,[phLogDetail]=HTTP response code failure 2025-01-26T20:04:09.099344+05:30 FSM_Collector phEventPackager[3607]: [PH_EVT_PACKAGER_FILE_UPLOAD_FAILURE]:[eventSeverity]=PHL_WARNING,[procName]=phEventPackager,[fileName]=phEventPKGProcess.cpp,[lineNumber]=1008,[filePath]=/opt/phoenix/cache/parser/events/evt_1731583984_2_21075.dat,[errorNoInt]=0,[destName]=WORKERFQDN,[phLogDetail]=Failed to upload event file to worker The below-mentioned steps can be followed to resolve such an issue: Verify on Collector/etc/hosts entries are correct for Supervisor, Worker FQDNs Check if Self Signed Certificates are used in the Environment. In case Self-signed certificates are being used, the following entry in /opt/phoenix/config/phoenix_config.txt needs to be adjusted.  http_client_verify_peer=no Also, the/opt/phoenix/config/collector_config_template.txt file on the Supervisor needs to be corrected such that the change is consistent across all new collectors. http_client_verify_peer=no Check again in the backend Phoenix logs of the collector and verify if the collector upload buffer gets cleared in GUI from Admin -> Health -> Collector Health. Related article: Troubleshooting Tip: How to troubleshoot collector issues