Technical Tip: How to restart Logs Related process using an automated script

[jera]

Description	This article describes how to mitigate and fix the conserve mode issue triggered when log related process is consuming a lot of memory.
Scope	FortiGate v7.2 and v7.4.
Solution	List of logs-related processes: LOCALLOG daemon: a process that handles local logging (hard disk). FGTLOG daemon: a process that handles remote logging (FortiCloud/FortiAnalyzer Cloud /FortiAnalyzer). Note: FortiOS 7.2.4 and above use the 'fgtlogd' daemon to check logging to FortiAnalyzer and FortiGate Cloud. See more details in this article: Troubleshooting Tip: FortiGate Logging debugs.  MIGLOG daemon: a process that handles the building and publishing of logs. Here is the generic CLI command to implement the restart: config system auto-script     edit "name_of_script"         set interval <-- Integer value from <0> to <31557600> in seconds.         set repeat <-- Integer value from <0> to <65535> (default = <1>). Number of times to repeat the script.         set start <-- Choose between auto or manually triggered.         set script "fnsysctl killall <-- Name of the process.     next end To verify top memory process utilization: Iriz-kvm28 # diagnose sys top-mem fgtlogd (28039): 47210kB  <-- Sample result. Here is a sample of the actual script that will run every 24 hours for one month (30 days) to restart/kill the remote logging ('fgtlogd') process. config system auto-script     edit "restart_fgtlogd"         set interval 86400         set repeat 30         set start auto         set script "fnsysctl killall fgtlogd"     next end To verify if the script is working, run the following command after 24 hours.