CPU persistently 80%+ on 100C (sqllogd)

[Frosty]

We have a single Fortigate FG200B and the logs are shipped to our single Fortianalyzer FL100C. Noticed some time ago that CPU was persistently over 80%. I thought this was due to logging of ' syslog' data. But last week I removed all such syslog activity, and the CPU is still stubbornly > 80%. I ran ' diagnose sys top' and watched it for a while. The culprit is ' sqllogd' . We converted this Fortianalyzer to use SQL logging about a year ago. Is it inherently ' bad' for CPU usage? Wondering what other people are noticing on their devices?

[Frosty]

Have opened a ticket now. Will update this thread with the outcome once resolved. My guess is that we are going to have to dump our logs and our config and re-initialise the device and start again from scratch!

[AtiT]

Hi, I had similar issue on the 100C but on older versions - 4.3.X. There was a problem that to much logs were received and the FAZ was not able to put the logs realtime into the SQL database. When I checked the logs, there were 2 days old logs in the Log View. Finally the problem was on the FortiGate. I disabled the log to fortianalyzer and all syslog and enabled it after a minute - it was OK. Check the logs received by second. If I remember it should not be higher than 100logs/s. After that I deletted all logs and let the database to rebuild.

[Frosty]

Thanks for the suggestions. On my FL100C it shows <100MB/day of log files. To my thinking, that is quite small. I added the Log Receive Monitor to the Dashboard and it shows mostly around 10 logs/sec with a couple of peaks occasionally as high as 20 logs/sec. I am starting to think that just junking all the existing logs/sql data would be a good idea. Might be good to revert the FL100C back to a Factory Defaults configuration with a brand new install of latest firmware and then see what it does. But I will wait for my ticket to be investigated first, just in case there is an easier fix.

[200B]

I recently upgraded two 100C' s from 4.3.7 to 5.0.6 I saw the CPU at 100% for a few hours on each device following the upgrade, sqllogd was the culprit. The devices had very little logs already onboard. I believe the high cpu was caused by conversion of existing logs to sql format - I noticed the sql db size increasing until the CPU returned to normal.

[Frosty]

Thanks for the tip. Yes, I knew about that one already however. Our device has been >80% for more than 6 months now! I have a ticket open and will post the outcome once we determine how to fix it.

[Frosty]

Am trying an upgrade to 4.0 MR3 Patch 8 ... this involves dumping the old SQL database and creating a new one (new schema) and importing old logs again ... will know in 24 hours whether this resolves my issue or not.

[Frosty]

Finally reached a resolution. The upgrade from 4.3.7 to 4.3.8 did not fix it. Yesterday I tried upgrading from 4.3.8 to 5.0.6 directly and now the CPU is running at <10% all the time. So I finally got there, but it seems I have lost all my historical log data in the process which is a bit of a shame.