Technical Tip: FortiEDR Core high memory usage

Description

This article discusses a possible reason for high Core memory usage.

Scope

FortiEDR Core.

Solution

Scenario: If the FortiEDR Core component is increasing steadily in memory usage, a possible reason is that the Core is unable to connect to the Threat Hunting Repository Kafka.

Explanation: When the Core is unable to access Kafka, it will start holding the events it should be reporting to Kafka in memory.

In turn, this will steadily increase the amount of memory usage as events are constantly reported by the Collectors and sent to the Core.

Resolution: Verify that the Core is able to access the THR on ports 9092, 32100, 32000, 32001, 32002.

Once communication can be established between the Core and Kafka, it will begin reporting the events and releasing them from memory, and usage will go back down.