FortiSIEM
FortiSIEM provides Security Information and Event Management (SIEM) and User and Entity Behavior Analytics (UEBA)
koolishami
Staff
Staff
Article Id 415962
Description This article describes the steps to resolve issues with the Explorer tab in FortiSIEM. The Explorer tab may not function as expected due to a bottleneck in redis memory, and this article provides a solution to clear the Redis cache and restart the Supervisor and Workers.
Scope FortiSIEM v7.x+.
Solution

Symptoms:

  • The Explorer tab is unresponsive or fails to display expected data.
  • Review /opt/glassfish/domains/domain1/logs/phoenix.log and see if below errors (or similar to) exist:

 

2025-09-30 09:28:30,189 [http-listener-2(21)] ERROR com.ph.phoenix.ws.rest.h5.H5RestResource

- [PH_APPSERVER_REST_H5_ERROR]:[phCustId]=1,[eventSeverity]=PHL_ERROR,[phEventCategory]=3,
[procName]=AppServer,[className]=com.ph.phoenix.service.util.ValidationHelper,

[methodName]=doCMDBReportFieldValidation,[lineNumber]=41,

[errReason]=Invalid CMDB report: invalid field activity_name,[phLogDetail]=HTML5 REST error
2025-09-30 09:28:30,300 [http-listener-2(18)] ERROR com.ph.phoenix.ws.rest.h5.H5RestResource

- [PH_APPSERVER_REST_H5_ERROR]:[phCustId]=1,[eventSeverity]=PHL_ERROR,[phEventCategory]=3,

[procName]=AppServer,[className]=com.ph.phoenix.service.util.ValidationHelper,

[methodName]=doCMDBReportFieldValidation,[lineNumber]=41,

[errReason]=Invalid CMDB report: invalid field incident_et,[phLogDetail]=HTML5 REST error

 

  • Review /opt/glassfish/domains/domain1/logs/server.log and see if below errors (or similar to) exist:

 

[2025-09-30T09:36:04.803+0800] [glassfish 5.1] [SEVERE] []

[com.ph.phoenix.framework.logging.PhLogger] [tid: _ThreadID=114 _ThreadName=http-listener-2(16)]

[timeMillis: 1759196164803] [levelValue: 1000] [[
Invalid CMDB report: invalid field activity_name
java.lang.IllegalArgumentException: Invalid CMDB report: invalid field activity_name
at com.ph.phoenix.service.util.ValidationHelper.doCMDBReportFieldValidation(ValidationHelper.java:41)
at com.ph.phoenix.ws.rest.h5.CmdbReportResource.query(CmdbReportResource.java:448)
at sun.reflect.GeneratedMethodAccessor6732.invoke(Unknown Source)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:498)
at org.glassfish.jersey.server.model.internal.ResourceMethodInvocationHandlerFactory.lambda$static$0

(ResourceMethodInvocationHandlerFactory.java:52)

 

To resolve the issue with the Explorer tab in FortiSIEM, follow these steps:

  1. Make sure to run the Content Update to ensure rules and reports are up-to-date. 
  2. Upgrade to the most stable version of FortiSIEM to address several bugs that may be encountered with the current version.
  3. Clear the Redis cache by running the command: echo 'flushall' | redis-cli -p 6666 -a `phLicenseTool --showRedisPassword`.
  4. Restart the Supervisor and Workers using the command: phxctl reboot.

 

Note: Ensure to use the correct syntax when running the command to clear the Redis cache. The command should be run with ` instead of '.

 

For detailed guidance on content updates, refer to:

Content Pack Updates