FortiSIEM Discussions
KarlH
New Contributor III

Stop Start collector features in GUI just keep spinning

A collector with high cpu usage. It's reporting, procs are up.. the stop start  seems to be very short in duration what is it actually doing?

 

Thanks

Karl Henning, Security Engineer, CISSP
Karl Henning, Security Engineer, CISSP
1 Solution
Secusaurus
Contributor II

Hi @KarlH,

 

We've seen this behavior on Collectors that have not enough resources for the amount of logs. In case of a VM, try to give it more RAM, CPU or a better drive (SSD, in case you're using HDD). Or use multiple Collectors instead of a single one to distribute the load.

 

Best,

Christian

FCP & FCSS Security Operations | Fortinet Advanced Partner

View solution in original post

FCP & FCSS Security Operations | Fortinet Advanced Partner
4 REPLIES 4
premchanderr
Staff
Staff

Hi @KarlH ,

 

Looks like the processes are crashing and recovering on its own. 

You would need to check which process #phstatus and probe further on the error.  Especially check for unknown events and events with large length/volume. 

Regards,
Prem Chander R
KarlH
New Contributor III

Ok thank you Prem!

Karl Henning, Security Engineer, CISSP
Karl Henning, Security Engineer, CISSP
Secusaurus
Contributor II

Hi @KarlH,

 

We've seen this behavior on Collectors that have not enough resources for the amount of logs. In case of a VM, try to give it more RAM, CPU or a better drive (SSD, in case you're using HDD). Or use multiple Collectors instead of a single one to distribute the load.

 

Best,

Christian

FCP & FCSS Security Operations | Fortinet Advanced Partner
FCP & FCSS Security Operations | Fortinet Advanced Partner
KarlH
New Contributor III

Will do thank you Christian!

Karl Henning, Security Engineer, CISSP
Karl Henning, Security Engineer, CISSP
Announcements

Welcome to your new Fortinet Community!

You'll find your previous forum posts under "Forums"