FortiSIEM
FortiSIEM provides Security Information and Event Management (SIEM) and User and Entity Behavior Analytics (UEBA)
Andy_G
Staff
Staff
Article Id 196382

Description

What causes it?  Caused by sudden memory increase to max level, which forces a restart of phReportMaster. This memory increase is caused by too many rpt files under  a ‘new’ directories in /data/eventdb/CUSTOMER_*/report/*/new

================================================================= 

Workaround:

 Look into the following directories to see if there are many files

/data/eventdb/CUSTOMER_xxxx/report/i[300,3600,900]/new

 Remove all .rpt files

find /data/eventdb/CUSTOMER_*/report/*/new –name "*.rpt" -print | xargs rm –f

=========================================================== 

 Bug # 12748 has been filed and will be addressed in 5.1.1.



Contributors