Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
micahawitt
New Contributor III

60F high mem

Hey All,

 

Just got a 60f and putting it through the paces.  I am noticing high mem around 60% and if np does anything basically goes to conserve mode and need to reboot.  Scoured cookbook and other googles and cant seem to find a good NPU best practice. 

 

Wondering if anyone else has played with this at all.  Using at home, about 10 policies, 2 of which do actual filtering.  

 

Just wondering thoughts.

1 Solution
darwin_FTNT

For FOS v6.4, just request IPS package v6.0.30 or later from TAC.

This is a new feature tracked by mantis 0613814: Reduce IPS memory consumption.

It is still being backported to FOS v6.2/6.0 later on as one of major features (not available yet currently, more testing likely pending).

Hopefully it would make it to the next IPS official public release for FOS v6.2/v6.0 (can't ascertain this).

 

View solution in original post

28 REPLIES 28
Toshi_Esumi
SuperUser
SuperUser

What process(es) seems to be taking up the memory most? "diag sys top 5 20" then "Shift-M".

Since it's a brand-new product with a new SOC4 chip, I would open a ticket with TAC right away.

James_G

Fortios version?
James_G

Ps interested how this plays out due to a comment I heard about soc4 not having a real NP, and was somehow software based / emulated. Could NP usage affect memory usage?????
tanr
Valued Contributor II

Are you on 6.2.2 and using proxy mode instead of flow? Lot of perf/memory bugs that were reported fixed in 6.2.3, many of which were WAD process, so flow mode might be a temp workaround. As others mentioned, we’re just guessing without a FortiOS version and diag says top.
James_G
Contributor III

Or, if this is a new implementation and the issues are that bad, try 6.0.8 Warning, it will require manual reconfig from scratch
micahawitt
New Contributor III

Running 6.2.2.  This is my attempt at coming back to Fortinet from the 5 days.

 

I will be calling TAC to get some info, but just to try an answer some of the questions here...

 

Which part would be proxy vs flow, looking through my list i didn't see anything glaring sticking out.

Also looking through cookbook to see if i can just turn off the NPU, right now it seems to be the app control that really pushes it over.

 

WIth the setup the only filtering on is web/av/dns

 

micahawitt

Run Time: 1 days, 2 hours and 3 minutes 0U, 0N, 0S, 100I, 0WA, 0HI, 0SI, 0ST; 1819T, 303F ipshelper 188 S < 0.0 16.9 ipsengine 255 S < 0.1 5.3 httpsd 4721 S 0.0 5.3 ipsengine 253 S < 0.0 5.3 ipsengine 256 S < 0.0 5.2 ipsengine 254 S < 0.1 5.2 cmdbsvr 128 S 0.0 2.3 scanunitd 6590 S < 0.0 1.9 pyfcgid 4455 S 0.0 1.9 pyfcgid 4454 S 0.0 1.9 pyfcgid 4451 S 0.0 1.8 scanunitd 175 S < 0.0 1.8 scanunitd 6592 S < 0.0 1.8 scanunitd 6587 S < 0.0 1.8 scanunitd 6588 S < 0.0 1.7 scanunitd 6589 S < 0.0 1.7 scanunitd 6591 S < 0.0 1.7 scanunitd 6593 S < 0.0 1.7 scanunitd 6594 S < 0.0 1.7 httpsd 4725 S 1.3 1.5 Run Time: 1 days, 2 hours and 3 minutes 0U, 0N, 0S, 100I, 0WA, 0HI, 0SI, 0ST; 1819T, 303F ipshelper 188 S < 0.0 16.9 ipsengine 255 S < 0.1 5.3 httpsd 4721 S 0.0 5.3 ipsengine 253 S < 0.0 5.3 ipsengine 256 S < 0.0 5.2 ipsengine 254 S < 0.1 5.2 cmdbsvr 128 S 0.0 2.3 scanunitd 6590 S < 0.0 1.9 pyfcgid 4455 S 0.0 1.9 pyfcgid 4454 S 0.0 1.9 pyfcgid 4451 S 0.0 1.8 scanunitd 175 S < 0.0 1.8 scanunitd 6592 S < 0.0 1.8 scanunitd 6587 S < 0.0 1.8 scanunitd 6588 S < 0.0 1.7 scanunitd 6589 S < 0.0 1.7 scanunitd 6591 S < 0.0 1.7 scanunitd 6593 S < 0.0 1.7 scanunitd 6594 S < 0.0 1.7 httpsd 4725 S 0.9 1.5

micahawitt

restarting the engine took me from 75% down to 63%

simonorch

I also have a 60F running 6.2.2 the last 6 weeks or so, with a couple of fortiswitches and and ap. got a mix of rules including a couple with AV, webfiltering etc. in proxy mode, no deep ssl inspection though. During that time i've had to reboot the box once due to a suspected problem with fortilink, it hadn't gone to conserve though.

6.2.3 isn't out yet for the SOC4 models.

NSE8
Fortinet Expert partner - Norway

NSE8Fortinet Expert partner - Norway
Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors