FG300D memory usage

[kinmun]

my FG300D firewall memory starts to go above 70% these few days?

such I be concerned 

it used to hover around 60-65%.

should I clear logs on the FG300D or do some housekeeping ???

the below alert is from my monitoring system.

Trigger: Memory usage exceeded 70%Trigger status: PROBLEMTrigger severity: AverageTrigger URL: Item values: 1. System Memory Usage(%) (Fortigate300D:fgSysMemUsage): 71 %

[rpedrica]

Hi @kinmun

There is some important info you haven't told us:

How long has the unit been running for ( uptime )?

Have you made changes are add policies with security profiles recently?

Have you enabled any additional features like VPN, vuln scan or device ident?

Has your traffic through the unit increase ( eg. sessions or users )?

Generally, changes in config will cause fluctuations in memory usage so this may be expected or not. Try to work our if changes have happened between mem=60% and mem=70%.

The FGs are normally Ok up to 75% memory but thereafter you might get into conserve mode with some disabled features.

[ede_pfau]

Which version of FortiOS are you running? Have you checked if there is an update, and (in the Release Notes) if there are issues resolved concerning the memory usage?

With UTM, you can burn any amount of memory. Check your IPS settings, for instance that you don't enable ALL signatures at once.

[kinmun]

my firmware is 5.2.2 and have been running for 300 days.

recent changes is to allow some online radio websites which were being blocked as p2p traffic.

no other changes made.

any commands i can use to check what are causing the spike in memory usage??

[ede_pfau]

I recommend to

a) reboot

b) upgrade to 5.2.3 or 5.2.4

Take step a) in any case. Additionally, check IPS settings, if IPS is applied for the right policies. Same for AppCtrl.

Step b) needs some reading into the Release Notes and a search across the forum. There are known issues with both releases which may or may not affect your configuration.

I wouldn't be surprised if Fortinet has fixed some memory leaks in the last 3 upgrades.

[kinmun]

will schedule a reboot of the FG and upgrade the firmware to 5.2.3.

this is what i get when i go a diagnose sys top-summary immediately after a sudden spike above 70%

  Mem [||||||||||||||||||||||||                ]  62.0%  4980M/7963M

   Processes: 20 (running=1 sleeping=133)

   PID      RSS  ^CPU% MEM%   FDS     TIME+  NAME

 * 86       25M    5.7  0.3    12  00:14.12  httpclid [x3]

   75      397M    2.8  5.0   368  19:18.47  ipsmonitor [x5]

   14357   130M    0.9  1.6  4598  38:30.41  proxyd [x8]

   3607     33M    0.0  0.4    11  00:41.38  pyfcgid

   3609     13M    0.0  0.2    31  02:53.90  iked

   14365    11M    0.0  0.1    14  00:00.29  dsd

   48       26M    0.0  0.3    15  09:29.60  cmdbsvr

   56       11M    0.0  0.1    87  00:12.50  zebos_launcher [x12]

   18492    41M    0.0  0.5    12  00:03.18  pyfcgid

   68       12M    0.0  0.2    16  40:33.58  uploadd

   69       30M    0.0  0.4    58  14:31.67  miglogd [x3]

   70       11M    0.0  0.1    12  11:03.11  ipmc_sensord

   71       11M    0.0  0.1     8  00:00.30  kmiglogd

   72       50M    0.0  0.6    25  00:15.83  httpsd [x5]

   74       11M    0.0  0.1     8  00:00.40  getty

   18507    31M    0.0  0.4    11  00:02.59  pyfcgid

   76       11M    0.0  0.1    10  00:00.28  merged_daemons

   77       11M    0.0  0.2    11  00:00.20  fnbamd

   31822    34M    0.0  0.4    12  02:35.64  pyfcgid

   81       11M    0.0  0.1    12  00:00.14  fclicense

FW # diagnose sys top-summary 

[bartman10]

It truly is a shame FortiNet does not allow us to upgrade the ram. It's simply DDR sticks. I can see them through the vent holes in my 300C. Why would they only put 2GB in the 300C and are so skimpy with ram. It's not like it would cost any more to have put 4GB in the thing and then it would not have ram issues! 

Heck even CISCO lets end users upgrade the ram in their ASA's!! CISCO!!! Without loosing support. 

If they think there is a RAM issue they will ask you to put the OEM ram back in but I have never had that happen to any of the units I had and I had upgraded them all to run ASA 9.x.

FortiNet, Please spend the extra $2 and put at least 4GB ram in your units, and let end users upgrade the RAM like CISCO does. There is no reason these units should be strangled with only 2gb or less of ram when many of them can be end user upgraded simply.

Thanks,