Technical Tip: High memory usage in the fgtlogd process when API queries to add or remove objects.

1. On FortiGate:

Configure FortiGate to send logs to FortiAnalyzer:

config log fortianalyzer setting

    set status enable

    set server "10.10.10.10"

end

2. After upgrading FortiGate firmware version to v7.4.1, when API queries are sent to add or remove objects, it causes high memory usage in the fgtlogd process.

FGT # diagnose sys top-mem 99

fgtlogd (246): 2495624kB

node (2055): 71900kB

wad (2132): 68128kB

ipshelper (2084): 33201kB

wad (2129): 21295kB

cmdbsvr (1969): 18607kB

cw_acd (2088): 15765kB

wad (2130): 14632kB

nsm (2022): 10735kB

...

FGT #

To fix the issue:

1. Temporary workaround: If the FortiAnalyzer visualization feature is not needed, cancel it by running the following CLI command on FortiAnalyzer:

diagnose test application oftpd 20 interval time=0 dev=<FortiGate’s Serial number>

Example:

diagnose test application oftpd 20 interval time=0 dev=FGTABC1234567890

2. Permanent fix: Upgrade the FortiGate firmware version to v7.4.9 or above.

To remove the workaround after upgrading the FortiGate to v7.4.9 and above, the following will need to be issued on FortiAnalyzer to re-enable the API:

diagnose test application oftpd 20 interval time=1800 dev=<FortiGate’s Serial number>

Example:

diagnose test application oftpd 20 interval time=1800 dev=FGTABC1234567890