Technical Tip: Interpreting the result of the CLI command 'diagnose sys top' from a Fortinet product
Description
This article explains how to understand and interpret the output of the command 'diagnose sys top'. Running this command has no side effects or impact on the system.
Scope
This applies to the following products: FortiGate, FortiAnalyzer, FortiMail, and FortiManager.
Solution
diagnose sys top <delay> <max_lines>
The command can be used with parameters to define the delay in seconds and the maximum lines to be displayed. The following example shows the output with a delay interval of 5 seconds and a maximum of 20 lines (processes) being displayed.
Example:
diagnose sys top 5 20
Run Time: 7 days, 5 hours and 5 minutes
0U, 0S, 30I; 502T, 372F, 61KF
thttp 43 S 0.0 4.7
ipsengine 49 S < 0.0 2.1
ipsengine 45 S < 0.0 2.0
cmdbsvr 18 S 0.0 1.8
httpsd 44 S 0.0 1.8
httpsd 78 S 0.0 1.8
httpsd 33 S 0.0 1.5
newcli 413 R < 0.0 1.3
newcli 403 S < 0.0 1.3
scanunitd 65 S < 0.0 1.2
scanunitd 64 S < 0.0 1.2
scanunitd 38 S < 0.0 1.1
merged_daemons 46 S 0.0 1.1
miglogd 29 S 0.0 1.0
updated 55 S 0.0 1.0
fdsmgmtd 56 S 0.0 1.0
forticron 47 S 0.0 0.9
authd 52 S 0.0 0.9
quard 60 S 0.0 0.9
fgfmd 63 S 0.0 0.9
0U, 0S, 30I; 502T, 372F, 61KF
thttp 43 S 0.0 4.7
ipsengine 49 S < 0.0 2.1
ipsengine 45 S < 0.0 2.0
cmdbsvr 18 S 0.0 1.8
httpsd 44 S 0.0 1.8
httpsd 78 S 0.0 1.8
httpsd 33 S 0.0 1.5
newcli 413 R < 0.0 1.3
newcli 403 S < 0.0 1.3
scanunitd 65 S < 0.0 1.2
scanunitd 64 S < 0.0 1.2
scanunitd 38 S < 0.0 1.1
merged_daemons 46 S 0.0 1.1
miglogd 29 S 0.0 1.0
updated 55 S 0.0 1.0
fdsmgmtd 56 S 0.0 1.0
forticron 47 S 0.0 0.9
authd 52 S 0.0 0.9
quard 60 S 0.0 0.9
fgfmd 63 S 0.0 0.9
Whilst the command is running one can type the following to modify and sort the output by memory and CPU usage:
Shift-P for CPU usage
Shift-M for MEM usage
The Run Time field displays the FortiOS' uptime value as a string.
The meaning of the letters on the second line of the output is given in the following table.
| Letter | Description |
| U | User cpu usage (%) |
| S | System cpu usage (%) |
| I | Idle cpu usage (%) |
| T | Total memory |
| F | Free memory |
| KF | Kernel free memory |
The following table describes the output format of the others lines.
| Column #1 | Column #2 | Column #3 | Column #4 | Column #5 |
| Process name | Process identification (PID) | One letter process status. S: sleeping process R: running process Z: zombie D: do not disturb / deep sleep <: high priority | CPU usage (%) | Memory usage (%) |
S, R, and D (for a short time) are considered normal states, while processes going into a D or Z state for long times are abnormal behavior and should be investigated.