Troubleshooting Tip: How to troubleshoot high phParser on FortiSIEM

[premchanderr]

Description	This article describes how to probe a high phParser issue on FortiSIEM.
Scope	FortiSIEM v7.x.
Solution	High phParser CPU usage in FortiSIEM (Supervisor or Collector) usually happens due to : Too many incoming logs at once. A large number of unknown or unrecognized event types increases parsing load. Long raw log messages take more CPU and memory to process. Log volume exceeded system resources or license.  Poorly formatted logs and an incomplete parser can cause inefficient parsing.  To identify the root cause from the FortiSIEM GUI : Note down the collector ID from the FortiSIEM Health tab. In case the supervisor has a high phParser, then Collector ID=1. Run a historical search for 1 hour or 1 Day: Filters: Collector ID = <xxx> AND System Event Category BETWEEN 0,6. Display conditions: Reporting IP, Event Name, Count(Matched Events). The above report would provide a count of events that is high, and one can take appropriate action. General Fixes for this involve parser fine-tuning, preventing irrelevant log collection, and scaling the resources of the FortiSIEM Node. Related article: Troubleshooting Tip: How to troubleshoot performance issues