FortiSIEM
FortiSIEM provides Security Information and Event Management (SIEM) and User and Entity Behavior Analytics (UEBA)
kdave
Staff
Staff
Article Id 366586
Description This article describes a way to resolve Connection Refused/Errors presented on FortiSIEM Dashboards.
Scope FortiSIEM.
Solution

While working with FortiSIEM Dashboards, Connection Refused/Errors are visible instead of an actual representation of data as per the below screenshot.

 

Screenshot_16.jpg

 

  • The following errors were observed in AppSvr logs:


tail -f /opt/glassfish/domains/domain1/logs/server.log

 

[2025-04-07T18:13:37.379+0530] [glassfish 5.1] [SEVERE] [] [com.ph.phoenix.framework.logging.PhLogger] [tid: _ThreadID=121 _ThreadName=http-listener-2(20)] [timeMillis: 1744029817379] [levelValue: 1000] [[

javax.ejb.EJBException
at com.sun.ejb.containers.EJBContainerTransactionManager.processSystemException(EJBContainerTransactionManager.java:728)
at com.sun.ejb.containers.EJBContainerTransactionManager.completeNewTx(EJBContainerTransactionManager.java:678)
at com.sun.ejb.containers.EJBContainerTransactionManager.postInvokeTx(EJBContainerTransactionManager.java:483)
at com.sun.ejb.containers.BaseContainer.postInvokeTx(BaseContainer.java:4576)
at com.sun.ejb.containers.BaseContainer.postInvoke(BaseContainer.java:2084)
at com.sun.ejb.containers.BaseContainer.postInvoke(BaseContainer.java:2054)
at com.sun.ejb.containers.EJBLocalObjectInvocationHandler.invoke(EJBLocalObjectInvocationHandler.java:196)
at com.sun.ejb.containers.EJBLocalObjectInvocationHandlerDelegate.invoke(EJBLocalObjectInvocationHandlerDelegate.java:64)
at com.sun.proxy.$Proxy608.run(Unknown Source)
at com.ph.phoenix.da.query.ReportServiceBean.doRunReport(ReportServiceBean.java:2765)
at com.ph.phoenix.da.query.ReportServiceBean.runReportWithHavingClause(ReportServiceBean.java:990)

..

Caused by: java.lang.IllegalArgumentException: Infinite recursion (StackOverflowError) (through reference chain: com.ph.phoenix.model.cmdb.User["manager"]->com.ph.phoenix.model.cmdb.User["manager"]->com.ph.phoenix.model.cmdb.User["primaryProfile"])
at com.fasterxml.jackson.databind.ObjectMapper._convert(ObjectMapper.java:3738)
at com.fasterxml.jackson.databind.ObjectMapper.convertValue(ObjectMapper.java:3656)

 

  • Check and confirm if the FortiSIEM Admin user has been assigned a Manager user recently.
  • From the GUI, remove the Manager User assigned to the Admin user from CMDB -> Users, select Edit User, remove the Manager User, and select Save.
  • If the Manager User cannot be removed from the GUI, check and remove the Manager User from the CLI using the commands below.

 

Taking a snapshot of the Supervisor instance is recommended before applying changes at the database level.

 

psql -U phoenix -d phoenixdb


SELECT id, name, manager_id, cust_org_id FROM ph_user WHERE name = '<Username>'; <----- Replace <Username> with the actual Username.

 

Note the ID of the user from the above step:


UPDATE ph_user SET manager_id = NULL WHERE id = '<ID>'; <----- Replace <ID> with actual ID as observed from the first step.

OR

manager_id can be set to NULL using the username as per the below command.

 

     UPDATE ph_user set manager_id=NULL where name='<username>';< ----- Replace <username> with the actual username

\q

 

  • Check again by refreshing Dashboards to see if they represent actual data and values.
Contributors