phFortiInsightAI process down

[knjuguna]

We issued reboot command to Worker node in fortiSIEM 7.1.3 ,

phFortiInsightAI process still down and does not start on  phtools --restart phFortiInsightAI

anyone who has encountered this ?

[ssudhakar]

Hello there :

Can you try using the following ??

systemctl restart phFortiInsightAI

Please let me know if that works!

-/Hope

[knjuguna]

Hello @ssudhakar status still the same, process is still down

[ssudhakar]

Can you try to stop and start rather than restart ?

systemctl stop phFortiInsightAI

systemctl start phFortiInsightAI

Do you see anything happening when you do this ? Like any dump/message on CLI ?

[knjuguna]

nothing is happening, there is no any dump/message on cli after running commands

[knjuguna]

phFortiInsightAI process is still down and cant start even after rebooting the worker again

[mnovelli · Accepted solution]

Hello @knjuguna . Is phFortiInsighAI active on Supervisor (run phstatus command). 

Have you tried to have a look to logs (/opt/phoenix/log/phoenix.log). Please try to run phtools --start phFortiInsightAI command on Worker and check if you retrieved some error from the log file /opt/phoenix/log/phoenix.log 

[mnovelli]

moreover, did you upgrade Fortisiem recently?

[mnovelli]

If you see in the log a message like that PH_AGENTMGR_JAVA_AGENT_ZOMBIE maybe this can be useful to fix the issue:

Here is example how to fix it, but you will need to find correct file in /usr/lib/jvm directory. So you can point it correctly ln -s /usr/lib/jvm/java-1.8.0-openjdk-1.8.0.342.b07-2.el8_6.x86_64 /etc/alternatives/java_sdk_1.8.0_openjdk

[knjuguna]

Hi @mnovelli 

please see below from the logs

2024-04-22T16:08:16.889639+03:00 wk_familyfinance phMonitorWorker[3979]: [PH_BASE_PROC_SYS_PROC_INFO_GET_FAILURE]:[eventSeverity]=PHL_WARNING,[procName]=phMonitorWorker,[fileName]=phSystemProcessInfo.cpp,[lineNumber]=447,[phLogDetail]=Failed to get system process information(/opt/phoenix/log/phFortiInsightAI.pid)