- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
phFortiInsightAI process down
We issued reboot command to Worker node in fortiSIEM 7.1.3 ,
phFortiInsightAI process still down and does not start on phtools --restart phFortiInsightAI
anyone who has encountered this ?
Solved! Go to Solution.
- Labels:
-
FortiSIEM
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello @knjuguna . Is phFortiInsighAI active on Supervisor (run phstatus command).
Have you tried to have a look to logs (/opt/phoenix/log/phoenix.log). Please try to run phtools --start phFortiInsightAI command on Worker and check if you retrieved some error from the log file /opt/phoenix/log/phoenix.log
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello there :
Can you try using the following ??
systemctl restart phFortiInsightAI
Please let me know if that works!
-/Hope
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello @ssudhakar status still the same, process is still down
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Can you try to stop and start rather than restart ?
systemctl stop phFortiInsightAI
systemctl start phFortiInsightAI
Do you see anything happening when you do this ? Like any dump/message on CLI ?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
nothing is happening, there is no any dump/message on cli after running commands
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
phFortiInsightAI process is still down and cant start even after rebooting the worker again
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello @knjuguna . Is phFortiInsighAI active on Supervisor (run phstatus command).
Have you tried to have a look to logs (/opt/phoenix/log/phoenix.log). Please try to run phtools --start phFortiInsightAI command on Worker and check if you retrieved some error from the log file /opt/phoenix/log/phoenix.log
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
moreover, did you upgrade Fortisiem recently?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If you see in the log a message like that PH_AGENTMGR_JAVA_AGENT_ZOMBIE maybe this can be useful to fix the issue:
Here is example how to fix it, but you will need to find correct file in /usr/lib/jvm directory. So you can point it correctly ln -s /usr/lib/jvm/java-1.8.0-openjdk-1.8.0.342.b07-2.el8_6.x86_64 /etc/alternatives/java_sdk_1.8.0_openjdk
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @mnovelli
please see below from the logs
2024-04-22T16:08:16.889639+03:00 wk_familyfinance phMonitorWorker[3979]: [PH_BASE_PROC_SYS_PROC_INFO_GET_FAILURE]:[eventSeverity]=PHL_WARNING,[procName]=phMonitorWorker,[fileName]=phSystemProcessInfo.cpp,[lineNumber]=447,[phLogDetail]=Failed to get system process information(/opt/phoenix/log/phFortiInsightAI.pid)
