FortiSOAR Knowledge Base
FortiSOAR: Security Orchestration and Response software provides innovative case management, automation, and orchestration. It pulls together all of an organization's tools, helps unify operations, and reduce alert fatigue, context switching, and the mean time to respond to incidents.
koolishami
Staff
Staff
Article Id 365771
Description

This article describes how to troubleshoot FortiSOAR GUI inaccessibility caused by a duplicate field in the Alert module. The issue results in system publish failures and errors during updates, impacting the GUI and playbook functionality.

Scope FortiSOAR v7.x+.
Solution

Root Cause:

The issue occurs when a duplicate field is added in the Alert module, causing the system publish process to fail with the following error:

 

Compile Error: Cannot redeclare App\Entity\Custom\Alert::<Function>()

in /opt/cyops-api/src/Entity/Custom/Alert.php on line <LineNumber>

 

Steps to Resolve:

 

  1. Verify the Error in Logs.

Check the system publish log to confirm the error:

 

# sudo tail -n 100 /var/log/cyops/cyops-api/last_system_publish.log

 

Look for a compile error similar to:

 

PHP Fatal error: Cannot redeclare App\Entity\Custom\Alert::XXXXXXXXXX()

in /opt/cyops-api/src/Entity/Custom/Alert.php on line 6475

 

  1. Clear Cache and Revert Metadata.

Run the following commands to clear the cache and revert metadata:

 

# sudo -u nginx php /opt/cyops-api/bin/console cache:clear

# sudo -u nginx php /opt/cyops-api/bin/console app:metadata:revert

 

  1. Update the System.

Execute the system update command:

 

# sudo -u nginx php /opt/cyops-api/bin/console app:system:update

 

If the GUI remains inaccessible, re-run the command with the -lah argument:

 

# sudo -u nginx php /opt/cyops-api/bin/console app:system:update -lah

 

  1. Restart Services.

Restart FortiSOAR services to ensure all components are functioning correctly:

 

# sudo csadm services --restart

 

  1. Verify GUI and Playbook Functionality.

Confirm that the GUI is now accessible and ensure playbooks are active and functioning properly.

 

Note:

If a '500 Server Error' occurs during playbook execution, re-check the system configuration and services.

 

Possible Steps Leading to the Issue:

  1. Adding a new field.
  2. Deleting the field.
  3. Adding another field with a duplicate name.
  4. Publishing the module.