FortiSIEM
FortiSIEM provides Security Information and Event Management (SIEM) and User and Entity Behavior Analytics (UEBA)
Andy_G
Staff
Staff
Article Id 196772

Description

Summary of Topic

This article describes how the collector status is determined

 

Additional Information

The Collector status mechanism works as follows. 

Every 5 seconds the Collector asks the Super if there is a task for him. 

This requests get saved by the Super. 

Every 10 minutes there is a process on the Super that checks how many tasks requests came from Collector in the past 10 minutes. 

If there were 0 then the Collector is reported as down. 

For the Collector to be seen as up again, there has to be x >= 3 task requests from the Collector within a 5 minute window. 

If App server does not hear from the collector, it generates an event (PH_COLLECTOR_DOWN) which triggers a rule and creates an Incident "System Collector Down".

 

Version Application

All



 

 

Contributors