FortiSIEM
FortiSIEM provides Security Information and Event Management (SIEM) and User and Entity Behavior Analytics (UEBA)
koolishami
Staff
Staff
Article Id 427637
Description This article describes the issue of being unable to obtain data from the app server after the restoration of a snapshot due to a failed upgrade (or any other reason). The article provides a step-by-step guide to resolving the issue by changing the permissions of the server.log file and re-deploying the App Server.
Scope FortiSIEM v7.x+.
Solution

The errors below are usually seen in /opt/phoenix/log/phoenix.log:

 

2026-01-21T22:30:53.096209-05:00 SupervisorHostname phMonitorSupervisor[12812]: [PH_HTTP_CLIENT_GET_DATA_FROM_CACHE_FAILED]:[eventSeverity]=PHL_ERROR,[procName]=phMonitorSupervisor,[fileName]=phHttpClient.cpp,[lineNumber]=1704,[errReason]=Cannot open HTTP cache file ,[phLogDetail]=Failed to get data from cache
2026-01-21T22:30:53.096235-05:00 SupervisorHostname phMonitorSupervisor[12812]: [PH_MONITOR_UNABLE_CONTACT_APPSVR]:[eventSeverity]=PHL_ERROR,[procName]=phMonitorSupervisor,[fileName]=phHttpEventPuller.cpp,[lineNumber]=107,[httpStatusCode]=404,[phLogDetail]=Unable to contact App Server, response code
2026-01-21T22:30:57.757419-05:00 SupervisorHostname phClickHouseMonitor[4415]: ERROR: 2026/01/21 22:30:57 redis_extractor.go:111: redis: nil
2026-01-21T22:30:58.018961-05:00 SupervisorHostname phMonitorSupervisor[12812]: [PH_HTTP_CLIENT_GET_RESPONSE_WARNING]:[eventSeverity]=PHL_WARNING,[procName]=phMonitorSupervisor,[fileName]=phHttpClient.cpp,[lineNumber]=703,[phLogDetail]=Unable to obtain data from app server, use cached data
2026-01-21T22:30:58.019029-05:00 SupervisorHostname phMonitorSupervisor[12812]: [PH_UTIL_FILE_OPEN_FAILURE]:[eventSeverity]=PHL_ERROR,[procName]=phMonitorSupervisor,[fileName]=phMiscUtils.cpp,[lineNumber]=3907,[filePath]=,[errorNoInt]=2,[phLogDetail]=Failed to open file

 

This is likely due to the backend processes (Phoenix) not being able to communicate with the GlassFish Application Server. 

 

To resolve the issue of being unable to obtain data from the app server after a failed upgrade, follow these steps:

 

  1. Make sure the GlassFish Phoenix log is printing logs in real-time:

 

tail -f /opt/glassfish/domains/domain1/logs/phoenix.log

 

  1. Ensure the App Server (GlassFish) logs permissions are correct:

 

ll /opt/glassfish/domains/domain1/logs/phoenix.log*

ll /opt/glassfish/domains/domain1/logs/server.log*

 

  1. The permissions should be as seen below:

 

-rw-rw-r-- 1 admin admin <-- For the .log files.

-rwxr-xr-x 1 admin admin <-- For the .gz files.

 

  1. Change the permissions of the server.log file to 'admin:admin' by running the following commands as root:

 

chown -R admin:admin /opt/glassfish/domains/domain1/logs/

chmod 755 /opt/glassfish/domains/domain1/logs/server.log

chmod 755 /opt/glassfish/domains/domain1/logs/phoenix.log

chmod 664 /opt/glassfish/domains/domain1/logs/server.log

chmod 664 /opt/glassfish/domains/domain1/logs/phoenix.log

 

  1. Re-deploy the App Server by running the following commands:

 

su admin

cd /opt/phoenix/deployment

./deploy-fresh.sh phoenix.ear