License Logs
This section provides logs related to licensing.
EventType: PH_CLUSTER_NO_LICENSE
Description: 670-Cluster: There is no license
Severity: 7 (Medium)
Event Category: 3 (System Logs)
EventType: PH_COLLECTOR_LICENSE_UPDATE
Description: License on collector updated
Severity: 5 (Medium)
Event Category: 3 (System Logs)
EventType: PH_LICENSE_ERROR
Description: FortiSIEM discovered license parsing error
Severity: 7 (Medium)
Event Category: 3 (System Logs)
Attributes:
|
Id |
Display name |
Type |
Description |
|---|---|---|---|
|
errorString |
Error String |
string |
This is the error message, synonymous to attribute errReason |
EventType: PH_LICENSE_INFO_FAILURE
Description: Failed to get license info
Severity: 6 (Medium)
Event Category: 3 (System Logs)
EventType: PH_LICENSE_INFO_INVALIDATED
Description: Invalid license
Severity: 6 (Medium)
Event Category: 3 (System Logs)
EventType: PH_LICENSE_NOT_EXIST
Description: There is no license file
Severity: 7 (Medium)
Event Category: 3 (System Logs)
EventType: PH_MODULE_LICENSE_FAILURE
Description: Module failed to get license
Severity: 6 (Medium)
Event Category: 3 (System Logs)
EventType: PH_MONITOR_LICENSE_ERROR
Description: phMonitor encountered license file error
Severity: 10 (High)
Event Category: 3 (System Logs)
Attributes:
|
Id |
Display name |
Type |
Description |
|---|---|---|---|
|
errReason |
Reason for Error |
string |
This is the reason for an error if given. |
EventType: PH_MONITOR_QUERY_LICENSE_FAILED
Description: Follower Super query license failed
Severity: 7 (Medium)
Event Category: 3 (System Logs)
Attributes:
|
Id |
Display name |
Type |
Description |
|---|---|---|---|
|
errorString |
Error String |
string |
This is the error message, synonymous to attribute errReason |
EventType: PH_MONITOR_REPORTSERVER_LICENSE_INVALID
Description: phMonitor found invalid Report Server license
Severity: 7 (Medium)
Event Category: 3 (System Logs)
Attributes:
|
Id |
Display name |
Type |
Description |
|---|---|---|---|
|
errorNoInt |
Error Number Int |
int32 |
|
EventType: PH_MONITOR_UPDATE_CERT_IN_LICENSE_FAILED
Description: Failed to update root certificate in license file
Severity: 7 (Medium)
Event Category: 3 (System Logs)
Attributes:
|
Id |
Display name |
Type |
Description |
|---|---|---|---|
|
destIpAddr |
Destination IP |
IP |
Destination IP of a device as identified in the event. |
|
errorString |
Error String |
string |
This is the error message, synonymous to attribute errReason |
EventType: PH_PARSER_GLOBAL_LICENSE_EXCEED
Description: Global EPS license exceeded and events will be dropped
Severity: 7 (Medium)
Event Category: 3 (System Logs)
Attributes:
|
Id |
Display name |
Type |
Description |
|---|---|---|---|
|
licenseEventsPerSec |
License EPS |
uint64 |
|
EventType: PH_SYSTEM_DISK_USAGE_EXCEED_LICENSE
Description: Event database disk usage exceeded limit
Severity: 10 (High)
Event Category: 3 (System Logs)
Attributes:
|
Id |
Display name |
Type |
Description |
|---|---|---|---|
|
phCustId |
Organization ID |
uint32 |
This is the FortiSIEM organization ID unique to each tenant |
EventType: PH_SYSTEM_EVENT_RATE_EXCEED_LICENSE
Description: System event rate exceeds licensed event rate
Severity: 5 (Medium)
Event Category: 3 (System Logs)
EventType: PH_TASK_NO_LICENSE
Description: There is no license
Severity: 7 (Medium)
Event Category: 3 (System Logs)
EventType: PH_VA_LICENSE_UPDATE
Description: License on VA has been updated
Severity: 5 (Medium)
Event Category: 3 (System Logs)