Editing phoenix_config.txt File
The file /opt/config/phoenix_config.txt
contains FortiSIEM run-time parameters. The parameters belong to 2 classes:
- Group 1: Preserved between upgrades - these parameters can be changed by the user and the changes will be preserved. For example:
# FSM upgrade preserves customer changes to parameter value
num_event_parser=16 #timeWithinSec requires at least 2 parser when former event will depend on later event - Group 2: Overwritten during upgrade - these parameters are considered internal to and owned by FortiSIEM and will be overwritten during upgrade. For example:
# FSM internal parameter; FSM overwrites
raw_sharedstore_size=268435456 #15M = 15728640, 64M = 67108864, 256M = 268435456, 512M = 536870912
Please follow these methods if you are intentionally making changes to these parameters.
- For parameters affecting Supervisor and Worker nodes, you can safely change Group 1 parameters and they will be preserved across upgrades. For Group 2 parameters, the changes will be effective, but will be overwritten during upgrade. Please contact Fortinet Support if you really need to preserve Group 2 parameter changes.
- For parameters affecting Collectors, instead of changing the
/opt/config/phoenix_config.txt
file, you need to change/opt/phoenix/config/collector_config_template.txt
on the Supervisor. This ensures that new Collectors registering will get the new parameters and the changes are preserved across upgrades. If you want to change the parameters for an existing Collector, then you need to make the same change in 2 places:- Change the
/opt/config/phoenix_config.txt
file on the Collector and restart the Collector. - Make the same change on
/opt/phoenix/config/collector_config_template.txt
on the Supervisor. This ensures that new Collectors registering will get the new parameters and the changes are preserved across upgrades.
- Change the