Skip to main content
Frosty
Frosty
New Member
February 17, 2014
Question

CPU persistently 80%+ on 100C (sqllogd)

  • February 17, 2014
  • 6 replies
  • 9171 views
We have a single Fortigate FG200B and the logs are shipped to our single Fortianalyzer FL100C. Noticed some time ago that CPU was persistently over 80%. I thought this was due to logging of ' syslog' data. But last week I removed all such syslog activity, and the CPU is still stubbornly > 80%. I ran ' diagnose sys top' and watched it for a while. The culprit is ' sqllogd' . We converted this Fortianalyzer to use SQL logging about a year ago. Is it inherently ' bad' for CPU usage? Wondering what other people are noticing on their devices?

    6 replies

    Frosty
    FrostyAuthor
    New Member
    February 24, 2014
    Have opened a ticket now. Will update this thread with the outcome once resolved. My guess is that we are going to have to dump our logs and our config and re-initialise the device and start again from scratch!
    AtiT
    AtiT
    New Member
    February 24, 2014
    Hi, I had similar issue on the 100C but on older versions - 4.3.X. There was a problem that to much logs were received and the FAZ was not able to put the logs realtime into the SQL database. When I checked the logs, there were 2 days old logs in the Log View. Finally the problem was on the FortiGate. I disabled the log to fortianalyzer and all syslog and enabled it after a minute - it was OK. Check the logs received by second. If I remember it should not be higher than 100logs/s. After that I deletted all logs and let the database to rebuild.
    Frosty
    FrostyAuthor
    New Member
    February 26, 2014
    Thanks for the suggestions. On my FL100C it shows <100MB/day of log files. To my thinking, that is quite small. I added the Log Receive Monitor to the Dashboard and it shows mostly around 10 logs/sec with a couple of peaks occasionally as high as 20 logs/sec. I am starting to think that just junking all the existing logs/sql data would be a good idea. Might be good to revert the FL100C back to a Factory Defaults configuration with a brand new install of latest firmware and then see what it does. But I will wait for my ticket to be investigated first, just in case there is an easier fix.
    200B
    200B
    New Member
    March 4, 2014
    I recently upgraded two 100C' s from 4.3.7 to 5.0.6 I saw the CPU at 100% for a few hours on each device following the upgrade, sqllogd was the culprit. The devices had very little logs already onboard. I believe the high cpu was caused by conversion of existing logs to sql format - I noticed the sql db size increasing until the CPU returned to normal.
    Frosty
    FrostyAuthor
    New Member
    March 5, 2014
    Thanks for the tip. Yes, I knew about that one already however. Our device has been >80% for more than 6 months now! I have a ticket open and will post the outcome once we determine how to fix it.
    Frosty
    FrostyAuthor
    New Member
    March 24, 2014
    Am trying an upgrade to 4.0 MR3 Patch 8 ... this involves dumping the old SQL database and creating a new one (new schema) and importing old logs again ... will know in 24 hours whether this resolves my issue or not.
    Frosty
    FrostyAuthor
    New Member
    May 7, 2014
    Finally reached a resolution. The upgrade from 4.3.7 to 4.3.8 did not fix it. Yesterday I tried upgrading from 4.3.8 to 5.0.6 directly and now the CPU is running at <10% all the time. So I finally got there, but it seems I have lost all my historical log data in the process which is a bit of a shame.
    Terms & ConditionsAccessibility statement