Viewing Cloud Health

The ADMIN > Health > Cloud Health page displays the status of the nodes in your deployment and the processes running on them. The top frame displays all of the available clouds and the lower frame provides information about the applications that are contained in the cloud selected in the main frame.

Complete these steps to view the information about Cloud health:

  1. Go to ADMIN > Health > Cloud Health tab.
  2. Click any node in the first frame to view its process details in the second frame.
    See the FortiSIEM Back-End Processes table for more information about the system role played by each process.

First Frame


Settings Description
Name Name of the available clouds
IP Address IP address of the available clouds
Module Role Module role, for example, 'Supervisor'
Health Current health of the cloud
Version Current version of the cloud
Upgrade Version Upgrade version number
Build Date Date when the cloud was created
Cores Number of cores
Load Average Average load of the cloud
CPU Percentage CPU used
Swap Size Swap size
Swap Used Swap used
Memory Size Maximum memory size
Memory Used Memory used
Up Time Total time that the cloud was in 'Up' status
Last Report Sync Time when the report was synched previously

Second Frame


Settings Description
Process Name Name of the process
Status Status of the process
Up Time Total up time of the process
CPU Measure of the CPU that the process is using
Event Rate Events used each second by the process
Physical Memory Amount of physical memory used by the process
Virtual Memory Amount of virtual memory used by the process
SharedStore ID and SharedStore Position SharedStore ID and position information

FortiSIEM Back-End Processes




Present in Supervisor

Present in Worker

Present in Collector

ApacheWebserver for front-ending http(s) requests to AppSvr or other FortiSIEM nodesxxx
AppSvrMiddleware for handling GUI requests, storing and managing PostgreSQL database and serving REST API requests from FortiSIEM nodesx  
DBSvrPostgreSQL Database for storing information displayed in FortiSIEM GUI other than eventsx  
phAgentManagerCollects logs and metrics from devices or servers using protocols other than SNMP and
phCheckpointCollects logs from Checkpoint firewalls via LEA   
phDataManagerStores the parsed events to event store (FortiSIEM EventDB or Elasticsearch)xx 
phDataPurgerArchives online event store (FortiSIEM EventDB or Elasticsearch). Implements event retention policy for FortiSIEM EventDB - both online FortiSIEM EventDB and archive.x  
phDiscoverDiscovers devices using various protocols such as SNMP, WMI and SSHx x
phEventForwarderForwards events from FortiSIEM to external Systemsxxx
phIpIdentityMasterMerges Identity and location audit trails from multiple phIpIdentityWorker modules to produce the final Identity and location audit trail. Stores the trail in PostgreSQL Database.   
phIpIdentityWorkerProduces Identity and location audit trail based on its own view of eventsxx 
phMonitorMonitors the health of FortiSIEM processes. Distributes tasks from AppSvr to various processes on Supervisor and to phMonitor on Worker for further dustribution to processes on Worker nodes.   
phParserParses raw events and preparses them for storing into event store (FortiSIEM EventDB or Elasticsearch)xxx
phPerfMonitorContinually collects performance monitoring and configuration change data after discovery completesxxx
phQueryMasterHandles Adhoc queries from GUI for FortiSIEM EventDB. Paralellizes queries by sending them to phQueryWorkers and merges individual results to produce the final result.x  
phQueryWorkerHandles individual FortiSIEM EventDB queries from phQueryMasterxx 
phReportLoaderLoads Report data into Report Server.x  
phReportMasterHandles individual FortiSIEM EventDB inline reports. Produces results every 5 minutes.x  
phReportWorkerHandles inline event reports FortiSIEM EventDB.Merges individual inline report results multiple phReportMaster modules to produce the final result. Rolls up results from 5 minute intervals to 15 minute intervals and then to 60 minute intervals.x  
phRuleMasterTriggers a rule in real time by evaluating rule summaries from individual phRuleWorker modulesx  
phRuleWorkerEvaluates a rule in real time based on events seen by the worker and sends a summary to the phRuleMaster modulexx 
RedisIn-memory distributed database for holding results returned by Elasticsearch and for distributing CMDB objects between Supervisor and Worker nodes.xx