| When the device is running with IPSE version 7.00349, ipsengine daemon may present high memory and CPU usage as shown below.
This issue has been resolved in IPS Engine v7.00351 (for FortiOS v7.2), v7.00553 (for FortiOS v7.4), and v7.01025 (for FortiOS v7.6).
diagnose sys top 5 40
Run Time: 52 days, 13 hours and 34 minutes
8U, 0N, 3S, 85I, 0WA, 1HI, 3SI, 0ST; 48377T, 29640F
ipsengine 30722 S < 24.5 0.9 14
ipsengine 30737 R < 22.0 0.9 18
ipsengine 30735 S < 21.5 0.9 12
ipsengine 30729 S < 21.5 0.9 15
ipsengine 30723 R < 21.5 0.8 0
ipsengine 30738 S < 21.0 0.8 19
ipsengine 30727 S < 20.5 0.9 5
ipsengine 30726 S < 20.5 0.9 4
ipsengine 30733 S < 20.0 0.9 9
ipsengine 30734 S < 20.0 0.8 10
ipsengine 30731 R < 19.5 0.9 7
ipsengine 30736 S < 19.5 0.9 13
ipsengine 30728 S < 19.5 0.8 6
ipsengine 30725 R < 18.5 0.9 3
ipsengine 30730 R < 18.5 0.9 17
ipsengine 30732 S < 18.5 0.9 11
ipsengine 30724 S < 18.5 0.9 1
ipsengine 30739 S < 17.5 0.9 20
bcm.user 2535 S < 11.0 0.2 2
diagnose sys top-fd 50
wad (5932): 1000
ipsengine (30722): 167
ipshelper (30714): 163
ipsengine (30723): 146
ipsengine (30724): 146
ipsengine (30725): 146
ipsengine (30726): 146
ipsengine (30727): 146
ipsengine (30728): 146
ipsengine (30729): 146
ipsengine (30730): 146
ipsengine (30731): 146
ipsengine (30732): 146
ipsengine (30733): 146
ipsengine (30735): 146
ipsengine (30736): 146
ipsengine (30737): 146
ipsengine (30738): 146
ipsengine (30739): 146
ipsengine (30734): 145
diagnose sys top-mem 20
ipsengine (30731): 329414kB
ipsengine (30727): 328417kB
ipsengine (30736): 325580kB
ipsengine (30725): 323762kB
ipsengine (30730): 322949kB
ipsengine (30733): 321078kB
ipsengine (30732): 320614kB
ipsengine (30735): 319355kB
ipsengine (30722): 318857kB
ipsengine (30739): 316804kB
ipsengine (30726): 316584kB
ipsengine (30724): 316219kB
ipsengine (30738): 314439kB
ipsengine (30737): 313210kB
ipsengine (30729): 312787kB
ipsengine (30728): 312211kB
ipsengine (30723): 310865kB
ipsengine (30734): 309195kB
To confirm if the FortiGate is running one of the mentioned versions use the following command: diagnose autoupdate versions | grep "IPS Attack" -A 5
IPS Attack Engine
---------
Version: 7.00349 signed <---
Contract Expiry Date: Thu Mar 6 2025
Last Updated using scheduled update on Tue Oct 22 20:43:34 2024
Last Update Attempt: 15:29:11 2024
Logs required by FortiGate TAC for investigation:
- Debugs:
execute date
execute time
get system status
get system performance status
get system session-info full-stat
diagnose hardware sysinfo shm
diagnose hardware sysinfo conserve
diagnose hardware sysinfo memory
diagnose sys top-mem 20
diagnose ips session status
diagnose ips packet status
diagnose ips memory status
diagnose ips raw status
diagnose ips session performance
diagnose test application ipsmonitor 3
diagnose test application ipsmonitor 14
diagnose test application ipsmonitor 15
diagnose test application ipsmonitor 24
diagnose test application ipsmonitor 2
diagnose autoupdate versions
- TAC Report:
execute tac report - Configuration file of the FortiGate.
| 
