Troubleshooting Tip: How to troubleshoot 'PH_PARSER_BIND_PORT_FAILURE' errors for phParser

[kdave]

Description	This article describes how to troubleshoot 'PH_PARSER_BIND_PORT_FAILURE' errors for phParser.
Scope	FortiSIEM.
Solution	The following error causes phParser process to remain down even after multiple attempts of turning it up. 2025-12-17T15:51:57.776933+01:00 FSIEM phParser[42569]: [PH_MODULE_ABORT]:[eventSeverity]=PHL_ERROR,[procName]=phParser,[fileName]=phBaseProcess.cpp,[lineNumber]=1600,[coreDumpFile]=(none),[phLogDetail]=Module exited abnormally 2025-12-17T15:52:02.640669+01:00 FSIEM phParser[42653]: [PH_PARSER_BIND_PORT_FAILURE]:[eventSeverity]=PHL_ERROR,[procName]=phParser,[fileName]=parserProcess.cpp,[lineNumber]=2068,[errorNoInt]=98,[phLogDetail]=Failed to bind TCP/514 ports 2025-12-17T15:52:02.640694+01:00 FSIEM phParser[42653]: [PH_PARSER_BIND_PORT_FAILURE]:[eventSeverity]=PHL_ERROR,[procName]=phParser,[fileName]=parserProcess.cpp,[lineNumber]=1144,[errorNoInt]=9,[phLogDetail]=Failed to bind TCP ports 2025-12-17T15:52:02.640709+01:00 FSIEM phParser[42653]: [PH_MODULE_INIT_FAILURE]:[eventSeverity]=PHL_ERROR,[procName]=phParser,[fileName]=phParser.cpp,[lineNumber]=31,[module]=phParser,[phLogDetail]=Module initialization failure The below steps can be followed to resolve the issue. Check which process is using TCP port 514 netstat -tulpn | grep 514 Check if rsyslog is using the same port. If Rsyslog is using port 514 before phParser, the process can be stopped: systemctl stop rsyslog Start phParser: su admin phtools --start phParser exit Once phParser is up, start rsyslog. systemctl start rsyslog