High CPU Usage all the time

Follow the following steps to troubleshoot this 1)Close the web GUI (it consumes CPU!) 2)log into the analyzer via SSH 3)use the following command to see what process is consuming the cpu and paste it here ;-)

 daig sys top 

(press Q to stop the diag sys top command) (if you use adoms first type config global)

The log_indexer is sometimes is around 96%, but not all the times and it' s the most consuming process. the weird thing is i opened two ssh sessions: 1 with " diag sys top" running and another one with a " diagnose sys cpu-mem" . here are the results.... the " top" command: Run Time: 6 days, 3 hours and 8 minutes 0U, 96N, 3S, 0I; 1011T, 784F, 0KF log_indexer 20358 R N 11.2 5.9 fortilogd 127 S 1.5 0.5 cli 20351 R 0.1 0.5 fdslogd 123 S 0.1 0.1 the diag cpu-mem one: FortiAnalyzer-100C # diagnose sys cpu-mem CPU usage: 100% Memory usage: 23% I am not using web ui, i just query cpu usage using snmp.

My 100B has high CPU all the time as well but is otherwise relatively functional. According to the MR3 docs, this is expected as it is constantly indexing all incoming traffic. The process is set to a low priority so that it can execute other tasks without it completely bogging down the FA.

A FortiAnalyzer unit deployed in a network can receive hundreds of log messages per second throughout the day. The FortiAnalyzer unit indexes nearly all fields in a log message to include it in the database. This process can be very CPU intensive, as the indexing component is continually running to keep up with the incoming log messages. . . . . All these tasks can be CPU intensive, especially when a combination of them is occurring at the same time. This often can cause the CPU usage to stay at 90% or more. It is important to set the indexing operation to the lowest priority so that the critical processes, such as receiving log messages, are not affected. On smaller devices, such as the FortiAnalyzer-100C, where the CPU and disk speeds are not as fast as the higher-end models, the CPU usage can appear more pronounced.

So, not sure if this is exactly your issue, but thought it might be something to look at.

Thanks for the reply. It is very satisfying. The FAZ, in fact, works properly and at a good speed regardless the 100% CPU usage, so your explaination is true. Thanks... now i can sleep tonight :)