How to fix FortiSIEM remove and rejoin worker Unknown code 1

This article describes how to resolve issues for rejoining workers with the error ‘Unknown code 1’ after removing it from the Supervisor.

Scope

FortiSIEM.

Solution

In some cases, users need to perform a rejoin of worker. However, it is common for users to encounter the error ‘Operation failed. Error = Failed to add worker with error: Unknown code 1’.

In some cases, users need to perform a rejoin of worker. However, it is common for users to encounter the error 'Operation failed. Error = Failed to add worker with error: Unknown code 1'.

This error commonly happens if the worker has joined the Supervisor before and is removed from the Supervisor with an NFS configured.

In this case, users need to remove the /data in workers for the Supervisor to reconfigure the workers again.

SSH to workers and run the command below:

#umount /data
#vi /etc/fstab
#remove the NFS entry in the fstab file & save it

After that, restart the worker and clear the browser cache or use an incognito mode to access the Supervisor when adding the worker again.

It may take a while for the changes to take effect, users can try to add the worker after a few hours.