Description | This article describes how to troubleshoot 'phIpIdentityWorker unable to keep up with incoming event rate' errors shown on the Supervisor GUI. |
Scope | FortiSIEM. |
Solution |
While checking on Supervisor Jobs/Errors or health page, the following error is observed:
phIpIdentityWorker unable to keep up with incoming event rate
This error suggests that the phIpIdentityWorker process on any one node is lagging behind. This can be confirmed by browsing to Admin -> Health -> Cloud health and drilling down to the processes of each node, comparing reader and writer positions for each. The node which has this issue will have discrepancies between the reader and writer positions for the phIpIdentityWorker process.
The following errors are observed in relation to the phIpIdentityMaster process on the Supervisor:
The following errors are observed on the Worker:
2025-08-08T13:24:57.475075+02:00 Worker1 phIpIdentityWorker[393086]: [PH_GENERIC_ERROR]:[eventSeverity]=PHL_ERROR,[procName]=phIpIdentityWorker,[fileName]=phMiscUtils.cpp,[lineNumber]=4615,[phLogDetail]=Failed to sent data to master at: 10.10.10.10 port: 7938
Check if port 7938 communication is healthy from the worker to the Supervisor.
On the Worker, check if any ini.err files exists in the /opt/phoenix/cache/parser/upload/svn directory.
ls -la /opt/phoenix/cache/parser/upload/svn | grep .err
Remove any ini.err files if they exist.
cd /opt/phoenix/cache/parser/upload/svn rm -rf *.err
Restart phIpIdentityWorker on the Worker:
killall -9 phIpIdentityWorker
Check again in the backend logs to see if the error exists. |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2025 Fortinet, Inc. All Rights Reserved.