From FortiOS 7.6.1 onward, the security rating report runs automatically every 8 hours. Refer to the documentation in Security Controls.
Run the following commands to see the report running:
diagnose debug application nodejs -1
diagnose web-ui backtrace enable
diagnose debug application httpsd -1
diagnose debug console timestamp enable
diagnose debug enable
The following output shows the report execution:
2026-05-07 07:59:56 miglog_socket_set_interface()-302: Binded interface index: 0.
2026-05-07 07:59:56 [httpsd 13309 - 1778151596 info] fweb_debug_final[456] -- Completed GET request for "/api/faz/sys/status" (HTTP 200)
[node CSF Topology - 1778151597 info] - Added FortiAnalyzer
[node CSF Topology - 1778151597 info] - {"deviceType":"fortianalyzer","serial":"FAZ-VMTMXXXXXXXX","version":"v7.6.4"}
[node Report Runner - 1778151600 info] - Running periodic Security Rating report.
[node CSF Topology - 1778151600 info] - Updating Fabric Appliances
[node REST-API - 1778151600 info] - Fetching /api/v2/monitor/log/device/state
[node REST-API - 1778151600 info] - Fetching /api/v2/cmdb/system/central-management
2026-05-07 07:59:59 2026-05-07 07:59:59 [httpsd 13378 - 1778151599 info] fweb_debug_init[615] -- New GET request for "/api/v2/cmdb/system/central-management" from "/tmp/httpsd-node.sock:0"
The following outputs demonstrate the memory usage increasing:
FGT # fnsysctldate
   Thu May 7 07:59:54 -03 2026
FGT # diagnose systop-mem 30
cw_acd (3806): 1332873kB
node (21075): 465564kB --> 465 MB
FGT # fnsysctldate
   Thu May 7 08:00:08 -03 2026
FGT # diagnose systop-mem 30
node (21075): 1580863kB --> 1.5 GB
cw_acd (3806): 1332870kB
FGT # fnsysctldate
   Thu May 7 08:00:37 -03 2026
FGT # diagnose systop-mem 30
node (21075): 4206458kB --> 4.2 GB
cw_acd (3806): 1332881kB
After the report execution, the memory decreases:
FGT # fnsysctldate
   Thu May 7 08:01:06 -03 2026
FGT # diag systop-mem 30
node (21075): 2289090kB --> 2.2 GB
cw_acd (3806): 1333496kB
FGT # fnsysctl date
   Thu May 7 08:01:20 -03 2026
FGT # diag sys top-mem 30
cw_acd (3806): 1333845kB
node (21075): 530333kB --> 530 MB
The same will occur at 16:00 and 00:00.
[2026-05-07 15:59:59.375] [node Web Request - 1778612399 info] - Completed request for "/api/v2/monitor/endpoint-control/ems/status-summary" (HTTP 200).
[2026-05-07 15:59:59.498] [node WebSocket - 1778612399 info] - Running websocket health check
[2026-05-07 16:00:00.040] [node Report Runner - 1778612400 info] - Running periodic Security Rating report.
[2026-05-07 16:00:00.041] [node CSF Topology - 1778612400 info] - Updating Fabric Appliances
[2026-05-07 16:00:00.246] [node REST-API - 1778612400 info] - Fetching /api/v2/monitor/log/device/state
[2026-05-07 16:00:00.246] [node REST-API - 1778612400 info] - Fetching /api/v2/cmdb/system/central-management
2026-05-07 23:59:48 [httpsd 31136 - 1778209188 info] fweb_debug_final[456] -- Completed GET request for "/api/v2/monitor/switch-controller/managed-switch/status" (HTTP 200 OK)
[node Web Request - 1778209188 info] - Completed request for "/api/v2/monitor/switch-controller/managed-switch/status" (HTTP 200).
[node Report Runner - 1778209200 info] - Running periodic Security Rating report.
[node CSF Topology - 1778209200 info] - Updating Fabric Appliances
[node WebSocket - 1778209200 info] - Running websocket health check
[node REST-API - 1778209200 info] - Fetching /api/v2/monitor/log/device/state
[node REST-API - 1778209200 info] - Fetching /api/v2/cmdb/system/central-management
2026-05-08 00:00:00 [httpsd 30962 - 1778209200 info] fweb_debug_init[615] -- New GET request for "/api/v2/monitor/log/device/state" from "/tmp/httpsd-node.sock:0"
In most cases, the memory increase of the 'Node' process will not be noted; however, for large environments where many devices like FortiSwitches and FortiAPs are managed, the process memory might spike from MB to GB, as demonstrated above.
| 
