Troubleshooting Tip: FortiSIEM Windows Agent consumes high CPU/Memory on Windows server

[premchanderr]

Description

This article describes how to investigate if FortiSIEM Windows Agent spikes high CPU utilization on Windows servers.

Scope

Windows Agent v4.4.x, v5.x, v7.x.x, v7.1.x, v7.2.x. Supervisor and Collector v6.x, v7.x, v7.1.x, v7.2.x.

Solution

1. Verify if high utilization is caused by the FortiSIEM Agent by checking the CPU and Memory Utilization of the FSMLogAgent process on the Windows server Task Manager. 
   
   

FortiSIEM Agents are designed to be lightweight and not consume more than 5% of a system's CPU and memory. 

2. Ensure that the system has met the pre-requisite defined in the Windows Agent Installation Guide and FortiSIEM Version Compatibility Matrix as per the installed agent version. 

3. On the Windows server navigate to Windows Event Viewer -> Application, System, and Security logs. Check if any event is generated by the FortiSIEM agent.

4. On the Windows server navigate to Windows Event Viewer -> Application, System, and Security logs. Assess for any unusually high number of events. In this case, fine-tune the system audit policies and analyze what is triggering such a high event rate. 

5. Investigate from the FortiSIEM Analytics tab to find out which event type count is maximum.

   Run a historical search for 10mins or 1 hour :
   
   Filters: Reporting IP = <Windows-IP> AND System Event Category BETWEEN 0,6

   Display conditions: Reporting IP , Event Name , Count(Matched Events)
   
   

   

   
   Export a 10-60 minutes duration report and review.

6. Temporarily exclude the high event type eventID from Windows Agent Template and click Apply on Template, to observe if system utilization has restored to normal. Later evaluate if still the event is required in FortiSIEM or can reduce the occurrence on Windows server.

7. Probe for any errors in Agent logs from the Windows server located in C:\ProgramData\FortiSIEM\Agent\Logs\.

8. Probe for any errors in FortiSIEM collector logs phAgentManager process :

   
   cat /opt/phoenix/log/phoenix.log | grep -i phAgentManager

9. Inspect Network Connectivity between the Windows server and collector for any latency. 

10. Verify if large events are cached on the Windows server. The cache for the Windows agent is stored in the following directory:

C:\ProgramData\AccelOps\Agent\Database\AoWinAgt.db

If still issue persists then contact Fortinet Support with all the above details.