60F high mem

[micahawitt]

Hey All,

Just got a 60f and putting it through the paces.  I am noticing high mem around 60% and if np does anything basically goes to conserve mode and need to reboot.  Scoured cookbook and other googles and cant seem to find a good NPU best practice. 

Wondering if anyone else has played with this at all.  Using at home, about 10 policies, 2 of which do actual filtering.  

Just wondering thoughts.

[Toshi_Esumi]

What process(es) seems to be taking up the memory most? "diag sys top 5 20" then "Shift-M".

Since it's a brand-new product with a new SOC4 chip, I would open a ticket with TAC right away.

[James_G]

Fortios version?

[James_G]

Ps interested how this plays out due to a comment I heard about soc4 not having a real NP, and was somehow software based / emulated. Could NP usage affect memory usage?????

[tanr]

Are you on 6.2.2 and using proxy mode instead of flow? Lot of perf/memory bugs that were reported fixed in 6.2.3, many of which were WAD process, so flow mode might be a temp workaround. As others mentioned, we’re just guessing without a FortiOS version and diag says top.

[James_G]

Or, if this is a new implementation and the issues are that bad, try 6.0.8 Warning, it will require manual reconfig from scratch

[micahawitt]

Running 6.2.2.  This is my attempt at coming back to Fortinet from the 5 days.

I will be calling TAC to get some info, but just to try an answer some of the questions here...

Which part would be proxy vs flow, looking through my list i didn't see anything glaring sticking out.

Also looking through cookbook to see if i can just turn off the NPU, right now it seems to be the app control that really pushes it over.

WIth the setup the only filtering on is web/av/dns

[micahawitt]

Run Time: 1 days, 2 hours and 3 minutes 0U, 0N, 0S, 100I, 0WA, 0HI, 0SI, 0ST; 1819T, 303F ipshelper 188 S < 0.0 16.9 ipsengine 255 S < 0.1 5.3 httpsd 4721 S 0.0 5.3 ipsengine 253 S < 0.0 5.3 ipsengine 256 S < 0.0 5.2 ipsengine 254 S < 0.1 5.2 cmdbsvr 128 S 0.0 2.3 scanunitd 6590 S < 0.0 1.9 pyfcgid 4455 S 0.0 1.9 pyfcgid 4454 S 0.0 1.9 pyfcgid 4451 S 0.0 1.8 scanunitd 175 S < 0.0 1.8 scanunitd 6592 S < 0.0 1.8 scanunitd 6587 S < 0.0 1.8 scanunitd 6588 S < 0.0 1.7 scanunitd 6589 S < 0.0 1.7 scanunitd 6591 S < 0.0 1.7 scanunitd 6593 S < 0.0 1.7 scanunitd 6594 S < 0.0 1.7 httpsd 4725 S 1.3 1.5 Run Time: 1 days, 2 hours and 3 minutes 0U, 0N, 0S, 100I, 0WA, 0HI, 0SI, 0ST; 1819T, 303F ipshelper 188 S < 0.0 16.9 ipsengine 255 S < 0.1 5.3 httpsd 4721 S 0.0 5.3 ipsengine 253 S < 0.0 5.3 ipsengine 256 S < 0.0 5.2 ipsengine 254 S < 0.1 5.2 cmdbsvr 128 S 0.0 2.3 scanunitd 6590 S < 0.0 1.9 pyfcgid 4455 S 0.0 1.9 pyfcgid 4454 S 0.0 1.9 pyfcgid 4451 S 0.0 1.8 scanunitd 175 S < 0.0 1.8 scanunitd 6592 S < 0.0 1.8 scanunitd 6587 S < 0.0 1.8 scanunitd 6588 S < 0.0 1.7 scanunitd 6589 S < 0.0 1.7 scanunitd 6591 S < 0.0 1.7 scanunitd 6593 S < 0.0 1.7 scanunitd 6594 S < 0.0 1.7 httpsd 4725 S 0.9 1.5

[micahawitt]

restarting the engine took me from 75% down to 63%

[simonorch]

I also have a 60F running 6.2.2 the last 6 weeks or so, with a couple of fortiswitches and and ap. got a mix of rules including a couple with AV, webfiltering etc. in proxy mode, no deep ssl inspection though. During that time i've had to reboot the box once due to a suspected problem with fortilink, it hadn't gone to conserve though.

6.2.3 isn't out yet for the SOC4 models.