|
It has often been observed that the collector stops sending events to the event worker with all the proper configuration in place and still does not upload events.
In the backend Phoenix logs of the collector, the following errors have been observed:
tail -f /opt/phoenix/phoenix.log | grep -i err
2025-07-24T10:02:06.571965+05:30 forticollector phEventPackager[3852]: [PH_EVT_PACKAGER_FILE_UPLOAD_FAILURE]:[eventSeverity]=PHL_WARNING,[procName]=phEventPackager,[fileName]=phEventPKGProcess.cpp,[lineNumber]=1013,[filePath]=/opt/phoenix/cache/parser/events/evt_1753326427_5257_1178112.dat,[errorNoInt]=401,[destName]=10.10.10.5,[phLogDetail]=Failed to upload event file to worker
- The destination is the Worker IP.
- Log in to Worker CLI and check the following file: /etc/httpd/accounts/passwds
- The first line, which shows as per the example below:
{"currentTime":1752146455,"nodeType":"Worker","role":null,"summary":"Normal","reason":"[{\"attribute\":\"CPU
- This is an additional line that gets added to the file
- Take a backup of the file and remove the line:
cp /etc/httpd/accounts/passwds /etc/httpd/accounts/passwds.backup
- Remove the additional line and save the file. Additional Steps only if the Collector needs to be re-registered.
- Check if the Collector Service account password is showing locked under the Users section in the GUI.
- If the collector Service account (Username starts with collector ID) is locked, unlock it
- Re-register collector:
mv /etc/opsd/.fortisiem4x0 /tmp
killall -9 phMonitor
- Re-run phProvisionCollector, add command:
# /opt/phoenix/bin/phProvisionCollector --add <user> '<password>' <Super IP or Host> <Organization> <CollectorName>
|
