FortiSIEM
FortiSIEM provides Security Information and Event Management (SIEM) and User and Entity Behavior Analytics (UEBA)
heng
Staff
Staff
Article Id 196444
Description
This article describes the behavior after a Super is rebooted. Right after the Super is rebooted, if log into the UI, an UI prompt to re-upload a license file will show up.
However, it is not due to the previous upload of the license file as it was working normally before the reboot.
Administrator may thinks it comes from the license file being corrupted or being removed after the reboot, which is why a re-upload UI being prompted.
Therefore, administrator will try to re-upload the license file again.


Solution
It is an expected behavior to see the mentioned prompt as the processes are not fully complete.
Allow sometimes for all the processes to come up. To verify this, run the CLI below command to see the state of all the processes:
#phstatus
Steps:
1) Login via SSH into the Super as root. 
2) If the UI prompt to re-upload the license file after a login show up, run CLI command below to see the state of all the processes.
#phstatus
The process state will be similar as the following:
PROCESS                  UPTIME         CPU%           VIRT_MEM       RES_MEM
phParser                 DOWN                         
phQueryMaster            DOWN                              
phRuleMaster             DOWN                            
phRuleWorker             DOWN                        
phQueryWorker            DOWN                            
phDataManager            DOWN                           
phDiscover               DOWN                         
phReportWorker           DOWN                            
phReportMaster           DOWN                         
phIpIdentityWorker       DOWN                    
phIpIdentityMaster       DOWN                           
phAgentManager           DOWN                              
phCheckpoint             DOWN                           
phPerfMonitor            DOWN                        
phReportLoader           DOWN                           
phBeaconEventPackager    DOWN                             
phDataPurger             DOWN                             
phEventForwarder         DOWN                          
phMonitor                DOWN
Apache                   00:17             0              223m           6056
Node.js                  00:11             0              923m           73m
AppSvr                   02:21             5              11139m         2609m
DBSvr                    02:52             0              376m           28m
3) Wait for a few minutes
    Once all the processes are up it will be possible to login into the Super normally.

The process state will be similar as the following:
PROCESS                  UPTIME         CPU%           VIRT_MEM       RES_MEM
phParser                 00:37             0              1821m          221m
phQueryMaster            00:54             0              883m           70m
phRuleMaster             00:54             0              551m           52m
phRuleWorker             00:54             0              1310m          317m
phQueryWorker            00:54             0              1338m          318m
phDataManager            00:54             0              1090m          48m
phDiscover               00:54             0              397m           42m
phReportWorker           00:54             0              1400m          317m
phReportMaster           00:54             0              458m           48m
phIpIdentityWorker       00:54             0              910m           47m
phIpIdentityMaster       00:54             0              371m           30m
phAgentManager           00:54             0              1287m          45m
phCheckpoint             00:54             0              99m            19m
phPerfMonitor            00:54             0              729m           52m
phReportLoader           00:54             0              708m           315m
phBeaconEventPackager    00:54             0              1029m          54m
phDataPurger             00:54             0              488m           45m
phEventForwarder         00:54             0              451m           37m
phMonitor                00:56             0              1196m          573m
Apache                   01:15             0              223m           6056
Node.js                  01:09             0              923m           73m
AppSvr                   03:19             0              11145m         2815m
DBSvr                    03:50             0              376m           28m


Contributors