Troubleshooting Tip: How to verify the Collector Event Upload Worker configuration from CLI

[kdave]

Description	This article describes how to verify the Collector Event Upload Worker configuration from CLI.
Scope	FortiSIEM.
Solution	The steps below need to be followed to verify if the Collector Event Upload Worker configuration is set properly on the collector while updating it from the GUI: Set Event Worker IP/FQDN from Admin -> Setup -> Organization -> Edit Org -> Collectors -> Edit Collector -> Set Event Worker IP -> Save -> Save.  Log in to Supervisor CLI and enter the command below to verify the same: psql -U phoenix phoenixdb -c "select property,value from ph_sys_conf where property ilike '%worker%';" Log in to Collector CLI and browse to the following directory: cd /opt/phoenix/cache/<SupervisorIP>/phoenix/rest/system/systemConfigs/collectorUploadSvr <-----  Replace <SupervisorIP> with actual IP of Supervisor. cat default.dat If the Worker IP is not reflected correctly in Collector Cache, make sure that there are no other Supervisor Cache directories in '/opt/phoenix/cache'. If any other Supervisor cache directories exist, remove the directory with incorrect/old Supervisor IPs  Reboot collector Check again if Collector Cache has the correct Worker IP.