Technical Tip: Email alert for single CPU core spike
Description
This article describes generating email alerts for a single CPU core spike.
Scope
FortiGate.
Solution
Refer below steps to configure the automation stitch for generating mail alerts for a single CPU core spike.
- Navigate Security Fabric and select Automation.
-
Select Create New to create a new automation stitch.
-
Configure the Name and enable the status.
-
Select Add Trigger to configure the trigger condition and then select Create New and then FortiOS Event Logs.
-
Configure the Name, select FortiOS Event ID: 40707, and select OK.
-
Once Automation Trigger is configured, apply the object to Trigger.
-
Select Add Action and New or select an existing email notification action.
-
After selecting New, select the Email option from the notification.
-
Configure the fields Name, From, To, and select OK.
-
Select OK.
Make sure the below command is enabled to log the event. Any single CPU core usage above the CPU usage threshold will report an event log.
config system global
set log-single-cpu-high enable
end
To make sure that the email daemon is working as expected, a test log email alert can be generated using the command: diagnose log alertmail test.
Debugging commands to verify and troubleshoot the email alert.
diagnose debug console timestamp e
diagnose debug app alertmail -1
diagnose debug en
The example alertmail debug output below can be used as a reference when the Automation Stitch for High CPU is triggered.
# 2026-02-13 08:45:21 Arrived msg(type 10, 1758 bytes):acvaldez@manila.ph;
stitchadmin@fortinet.com
Admin login successful
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta http-equiv="X-UA-Compatible" content="IE=8; IE=EDGE">
<meta name="viewport" content="width=device-width, initial-scale=1">
<link href="https://fonts.googleapis.com/css?family=Roboto&display=swap" rel="stylesheet">
<style>
body {
height: 100%;
font-family: Roboto, Helvetica, Arial, sans-serif;
margin: 0;
display: flex;
align-items: center;
justify-content: center;
}
.message-container{
margin: 0 auto;
max-width: 580px;
}
.email-body {
line-height: 1.5em;
}
</style>
</head>
<body>
<div class="message-container">
<img src="https://filestore.fortinet.com/fortiguard/logo_v3_fguard_app.png" alt="Fortinet Logo"/>
<h1>Security Fabric Automation</h1>
<h3>FGVM01TM21001378: LOGIN ATTEMPT</h3>
<div class="email-body">
date=2026-02-13 time=08:45:21 devid="FGVM01TM21001378" devname="Ertiga-kvm06" eventtime=1770943520888105719 tz="+0800" logid="0100032001" type="event" subtype="system" level="information" vd="root" logdesc="Admin login successful" sn="1770943520" user="admin" ui="jsconsole" method="jsconsole" srcip=10.250.0.40 dstip=10.47.19.63 action="login" status="success" reason="none" profile="super_admin" msg="Administrator admin logged in successfully from jsconsole"
</div>
</div>
</body>
</html>
2026-02-13 08:45:21 mail_info:
from:mail.manila.ph user:stitchadmin@fortinet.com
2026-02-13 08:45:21 mail_info:
reverse path:stitchadmin@fortinet.com
user name:stitchadmin
2026-02-13 08:45:21 to[0]:acvaldez@manila.ph
2026-02-13 08:45:21 <==_init_mail_info
2026-02-13 08:45:21 create session
2026-02-13 08:45:21 ==> send mail
2026-02-13 08:45:21 connecting to 10.47.20.197 port 25
2026-02-13 08:45:21 send mail 0x55f2986c8a50 session 0x55f2986c85c0
2026-02-13 08:45:21 session: 0x55f2986c85c0, rsp_state: greeting, code: 220
2026-02-13 08:45:21 session: 0x55f2986c85c0, rsp_state: ehlo, code: 250
2026-02-13 08:45:21 session: 0x55f2986c85c0, rsp_state: mail, code: 250
2026-02-13 08:45:21 session: 0x55f2986c85c0, rsp_state: rcpt, code: 250
2026-02-13 08:45:21 session: 0x55f2986c85c0, rsp_state: data, code: 354
2026-02-13 08:45:21 === send: <!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta http-equiv="X-UA-Compatible" content="IE=8; IE=EDGE">
<meta name="viewport" content="width=device-width, initial-scale=1">
<link href="https://fonts.googleapis.com/css?family=Roboto&display=swap" rel="stylesheet">
<style>
body {
height: 100%;
font-family: Roboto, Helvetica, Arial, sans-serif;
margin: 0;
display: flex;
align-items: center;
justify-content: center;
}
.message-container{
margin: 0 auto;
max-width: 580px;
}
.email-body {
line-height: 1.5em;
}
</style>
</head>
<body>
<div class="message-container">
<img src="https://filestore.fortinet.com/fortiguard/logo_v3_fguard_app.png" alt="Fortinet Logo"/>
<h1>Security Fabric Automation</h1>
<h3>FGVM01TM21001378: LOGIN ATTEMPT</h3>
<div class="email-body">
date=2026-02-13 time=08:45:21 devid="FGVM01TM21001378" devname="Ertiga-kvm06" eventtime=1770943520888105719 tz="+0800" logid="0100032001" type="event" subtype="system" level="information" vd="root" logdesc="Admin login successful" sn="1770943520" user="admin" ui="jsconsole" method="jsconsole" srcip=10.250.0.40 dstip=10.47.19.63 action="login" status="success" reason="none" profile="super_admin" msg="Administrator admin logged in successfully from jsconsole"
</div>
</div>
</body>
</html>
2026-02-13 08:45:21 session: 0x55f2986c85c0, rsp_state: data2, code: 250
2026-02-13 08:45:21 session: 0x55f2986c85c0, rsp_state: quit, code: 221
2026-02-13 08:45:21 session finined
2026-02-13 08:45:21 _session_on_destroy
2026-02-13 08:45:21 <== send mail success, m = 0x55f2986c8a50 s = 0x55f2986c85c0 
 
The following is an example email notification that will be sent once the CPU Automation Stitch is triggered.
Related article: