FortiSIEM
FortiSIEM provides Security Information and Event Management (SIEM) and User and Entity Behavior Analytics (UEBA)
kdave
Staff
Staff
Article Id 384950
Description This article describes how to start the phFortiInsightAI process if it cannot be started after the upgrade.
Scope FortiSIEM.
Solution

It has been observed in some cases that phFortiInsightAI process remains down after upgrading Firmware version from v7.3.0 to v7.3.1. The following error is shown on journalctl logs.

 

journalctl -xe --no-pager | grep phFortiInsightAI

 

image (36).png

 

-- Unit phFortiInsightAI.service has finished starting up.
--
-- The start-up result is done.
Mar 20 14:38:17 supervisor "phFortiInsightAI"[34966]: Error: A JNI error has occurred, please check your installation and try again
Mar 20 14:38:17 supervisor "phFortiInsightAI"[34966]: Exception in thread "main" java.lang.UnsupportedClassVersionError: com/zonefox/ai/AI has been compiled by a more recent version of the Java Runtime (class file version 65.0), this version of the Java Runtime only recognizes class file versions up to 52.0
Mar 20 14:38:17 supervisor "phFortiInsightAI"[34966]: at java.lang.ClassLoader.defineClass1(Native Method)
Mar 20 14:38:17 supervisor "phFortiInsightAI"[34966]: at java.lang.ClassLoader.defineClass(ClassLoader.java:756)
Mar 20 14:38:17 supervisor "phFortiInsightAI"[34966]: at java.security.SecureClassLoader.defineClass(SecureClassLoader.java:142)
Mar 20 14:38:17 supervisor "phFortiInsightAI"[34966]: at java.net.URLClassLoader.defineClass(URLClassLoader.java:473)
Mar 20 14:38:17 supervisor "phFortiInsightAI"[34966]: at java.net.URLClassLoader.access$100(URLClassLoader.java:74)
Mar 20 14:38:17 supervisor "phFortiInsightAI"[34966]: at java.net.URLClassLoader$1.run(URLClassLoader.java:369)
Mar 20 14:38:17 supervisor "phFortiInsightAI"[34966]: at java.net.URLClassLoader$1.run(URLClassLoader.java:363)
Mar 20 14:38:17 supervisor "phFortiInsightAI"[34966]: at java.security.AccessController.doPrivileged(Native Method)
Mar 20 14:38:17 supervisor "phFortiInsightAI"[34966]: at java.net.URLClassLoader.findClass(URLClassLoader.java:362)
Mar 20 14:38:17 supervisor "phFortiInsightAI"[34966]: at java.lang.ClassLoader.loadClass(ClassLoader.java:418)
Mar 20 14:38:17 supervisor "phFortiInsightAI"[34966]: at sun.misc.Launcher$AppClassLoader.loadClass(Launcher.java:352)
Mar 20 14:38:17 supervisor "phFortiInsightAI"[34966]: at java.lang.ClassLoader.loadClass(ClassLoader.java:351)
Mar 20 14:38:17 supervisor "phFortiInsightAI"[34966]: at sun.launcher.LauncherHelper.checkAndLoadMain(LauncherHelper.java:621)
Mar 20 14:38:17 supervisor systemd[1]: phFortiInsightAI.service: Main process exited, code=exited, status=1/FAILURE
Mar 20 14:38:17 supervisor systemd[1]: phFortiInsightAI.service: Failed with result 'exit-code'.
-- Subject: Unit failed
-- Defined-By: systemd
-- Support: https://lists.freedesktop.org/mailman/listinfo/systemd-devel
--
-- The unit phFortiInsightAI.service has entered the 'failed' state with result 'exit-code'.

 

The below steps can be followed to get the process up and running again.

  • Take a backup of /etc/systemd/system/phFortiInsightAI.service.
  • Compare the content of /tmp/upgrade/services/phFortiInsightAI.service. and /etc/systemd/system/phFortiInsightAI.service and replace the Java class path as below.

 

vi /etc/systemd/system/phFortiInsightAI.service

 

Replace the following line:

 

ExecStart=/bin/bash -c "exec -a phFortiInsightAI -c /opt/Java/bin/java -classpath \"/opt/fortiinsight-ai/lib/*\" -Xmx8192M com.zonefox.ai.AI"

 

With the following line:

 

ExecStart=/bin/bash -c "exec -a phFortiInsightAI -c /usr/lib/jvm/java-21/bin/java -classpath \"/opt/fortiinsight-ai/lib/\" -Xmx8192M com.zonefox.ai.AI"

 

Save the file:

 

:wq!

 

  • Then, enter the below commands to start the service.

 

systemctl daemon-reload

systemctl start phFortiInsightAI

 

  • Check the status of the Service:

 

systemctl status phFortiInsightAI