Skip to main content
A
Anonymous_User
Contributor
June 10, 2008
Question

ipsengine -> 100% CPU

  • June 10, 2008
  • 6 replies
  • 6244 views
Hello, I have noticed that the ipsengine CPU process has taken suddenly 100% ot the fortigate 300A load. I removed the ips processing in all the rules without changes. Can i use a command to restart the ips engine? Will i take a risk on the entire system if i kill brutally the ipsengine process? thanks a lot CC

    6 replies

    emnoc
    emnoc
    New Member
    June 13, 2008
    What version of the ips engine are you running ? We had a problem with this until we pushed a new IPSsignDB file.
    stefano_tufoni
    stefano_tufoni
    New Member
    June 13, 2008
    I have the same problem. As soon as I change the state (enable or disable) of a signature the CPU load jump to 100%. I have a blade system with FG5001, FortiOS 3.00-b0572(MR5 Patch 4)
    A
    Anonymous_UserAuthor
    Contributor
    June 16, 2008
    I have the same issue and at first support said it was a one-time issue due to an IPS engine update however it has happened several times since. You can restart the ipsengine by issuing the following command: diag test app ipsmonitor 2 diag test app ipsmonitor 2 Yes, you have to execute it twice. Once to stop the ipsengine and once to start it back up. You can find out what version of the IPS engine you' re running using this command (I' m on 1.092): get system fortiguard-service status I' m hoping that the TAC will have a permanent fix shortly but I' m not counting on it . . .
    g3rman
    g3rman
    New Member
    June 19, 2008
    As per our Fortinet SE Engine 1.093 should resolve this problem.
    A
    Anonymous_UserAuthor
    Contributor
    June 20, 2008
    g3rman, engine 1.095 is being distributed by support to fix the issue. Apparently they' re still QAing it for full release in the next few weeks. I don' t know if this means that 1.093 still has the issue or not.
    g3rman
    g3rman
    New Member
    July 3, 2008
    As per our SE they are now releasing Engine 1.096 which fixes the infinite loop condition which causes the high CPU utilization. I keep pushing for a date but they appear to be taking their time to make sure the problem is solved. At the same time I found that instead of stopping and starting the process as per the post above you can also use a single " restart" command: diag test app ipsmonitor 99 Test level 99 can be used for restarting all other services as well as far as I am aware of.
    Terms & ConditionsAccessibility statement