Description
This article describes how to optimize the system when high CPU and/or memory issue is happening with IPS process.
Scope
FortiGate.
Solution
Adjust the bellow settings.
# config ips global
set socket-size [integer, 0-512] <----- IPS socket buffer size. Max and default value depend on available memory. Lower value reduces memory usage.
set engine-count [integer, 0-255] <----- Number of IPS engines running. The default value of 0, FortiOS sets the number to optimize performance depending on the number of CPU cores. Reduce it to the number of cores the FortiGate box has.
set database [regular|extended] <----- Regular protects against the latest common and in-the-wild attacks. Extended includes protection from legacy attacks.
end
After changing the engine, database and socket size, restart the IPSEngine using the following command:
diag test app ipsmonitor 99
