Technical Tip: Configuring SNMP traps for receiving fgTrapPerCpuHigh traps
Description
This article describes how to configure SNMP traps on a FortiGate and receive fgTrapPerCpuHigh traps due to an 'updated' daemon.
Scope
FortiGate.
Solution
SNMP traps use a push model where the SNMP agent (FortiGate) sends traps to the SNMP manager (monitoring tool).
There is also a pull model where the SNMP Manager sends requests to the SNMP agent.
Traps can be configured from both GUI and CLI.
GUI.
System -> SNMP -> SNMP v1/v2c and select 'Create New'.
Fill in the fields then select 'OK'.
CLI.
config system snmp community
edit 1
set name “Email-Traps”
config hosts
edit 4
set ip 1.1.1.1/32
set host-type trap
next
end
edit 1
set name “Email-Traps”
config hosts
edit 4
set ip 1.1.1.1/32
set host-type trap
next
end
set events cpu-high
next
end
config system snmp sysinfo
set status enable -> disabled by default
set trap-high-cpu-threshold 80 <----- CPU usage when the trap is sent. The default value is 80.
end
end
config system snmp sysinfo
set status enable -> disabled by default
set trap-high-cpu-threshold 80 <----- CPU usage when the trap is sent. The default value is 80.
end
If SNMP traps are configured, high CPU usage traps will be only sent when the CPU utilization reach the default threshold of 80%.
CPU utilization on FortiGate in general is at normal level.
How to test the High CPU traps:
There is an 'updated' daemon on the FortiGate that is used to update AV/IP spam/web filter signatures via the FortiGuard server.
diagnose system top-summary
updated 1456 R N 99.9 0.3 <----- Showing 99.9% CPU utilization. The high CPU spike occurs for 1-2 seconds only.
updated 1456 R N 99.9 0.3 <----- Showing 99.9% CPU utilization. The high CPU spike occurs for 1-2 seconds only.
Note: The top-summary command was deprecated on FortiOS 6.4.x and onwards. Instead, use 'diagnose sys top'.
When the 'execute update-now' command is executed, notice that CPU utilization of the 'updated' daemon goes high for 2 seconds before it normalizes. FortiGate does not log but sends High CPU traps to the SNMP Manager.
This is an expected behavior as all the AV/IPS/Web Filtering/ISDB signatures are requesting an update from the FortiGuard server.
To avoid receiving high CPU traps during business hours, the updates from the FortiGuard server can be scheduled to run at a particular time or after office hours.
The settings can be found under the GUI from System -> FortiGuard -> AntiVirus & IPS Updates -> Scheduled Updates.
If the log is required for audit purposes and to know the reason for the spike, an automation stitch can also be configured to trigger a CLI script upon reaching a certain CPU Threshold based on the article below:
Technical Tip: Execute a CLI script based on high CPU
To avoid receiving high CPU traps during business hours, the updates from the FortiGuard server can be scheduled to run at a particular time or after office hours.
The settings can be found under the GUI from System -> FortiGuard -> AntiVirus & IPS Updates -> Scheduled Updates.
If the log is required for audit purposes and to know the reason for the spike, an automation stitch can also be configured to trigger a CLI script upon reaching a certain CPU Threshold based on the article below:
Technical Tip: Execute a CLI script based on high CPU
If the issue persists after successful configuration, troubleshoot and share the logs using the article below when opening the TAC ticket.
Troubleshooting Tip: How to troubleshoot SNMP traps not getting generated from the firewall