FortiGate
FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
pkumari
Staff
Staff
Article Id 249211
Description This article explains how to create an alert when a specific CPU core reaches high levels of activity.
Scope Any supported version of FortiGate.
Solution

Below is an example of core CPU usage details that can be observed in a system performance status check:


# get system performance status
CPU states: 23% user 0% system 0% nice 66% idle 10% iowait 0% irq 1% softirq
CPU0 states: 21% user 1% system 0% nice 77% idle 0% iowait 0% irq 1% softirq
CPU1 states: 31% user 1% system 0% nice 65% idle 3% iowait 0% irq 0% softirq
CPU2 states: 54% user 0% system 0% nice 22% idle 24% iowait 0% irq 0% softirq
CPU3 states: 25% user 1% system 0% nice 73% idle 0% iowait 0% irq 1% softirq
CPU4 states: 13% user 1% system 0% nice 75% idle 8% iowait 0% irq 3% softirq
CPU5 states: 16% user 0% system 0% nice 37% idle 44% iowait 0% irq 3% softirq
CPU6 states: 17% user 0% system 0% nice 83% idle 0% iowait 0% irq 0% softirq
CPU7 states: 9% user 1% system 0% nice 89% idle 0% iowait 0% irq 1% softirq


There is no option to directly trigger an event to occur when a specific core reaches high CPU usage. However, the 'per-cpu-high' option under the SNMP community can be enabled to achieve similar results:


# config sys snmp community

    edit 1
        set events per-cpu-high

 

If this option is enabled, SNMP will send a trap when per-CPU usage is high in the firewall. Set the threshold with the following commands:

 

# config system global
    set cpu-use-threshold <percent> <----- This will be calculated for the total CPU usage.
    set memory-use-threshold-extreme <percent>
    set memory-use-threshold-green <percent>
    set memory-use-threshold-red <percent>
end

 

This means that if either of the core CPUs reaches high usage, an event will trigger when the firewall reaches the usage threshold.