FortiClient Slowing Down Server

[foshejh]

To All,

  Is anyone experiencing issues where a Windows Server is gradually slowing down over the course of a few days with FortiClient running?  We have been experiencing this issue for several months, and we constantly unregister, shutdown, restart, and re-register the FortiClient every few days (2-3 days) to return to normal speed.

  We are seeing an overall slowing of performance across all aspects of the Server after FortiClient has been running for several days.  Today, after approximately 5 days of uptime, it took 10 seconds or more to simply open an empty network folder in windows explorer...  Viewing the Task Manager on the Server, CPU usage was around 50% or so, with FortiClient Scheduler (32 bit) using most of the CPU resource.  Normal CPU usage on our server is less than 10%...  After shutting down FortiClient, normal operations return immediately.  Even restarting FortiClient seems to work well for a while.  

  We are running Server 2012R2 on a host server and two virtual servers through HyperV.  We have the latest version of FortiClient (5.2.3) loaded on the server and all clients.  I understand that previous versions of FortiClient were not supported for server installation, but the release notes say that 5.2.3 is compatible with Server 2012R2.

  Thanks in advance for your help on this matter

Thanks,

-foshejh

[kolawale_FTNT]

To isolate which FortiClient feature is causing this, you could disable the main features, one at a time: Antivirus, Web Filtering, Application Firewall.  To disable Web Filtering, disable FortiProxy from the File -> Settings page.

[foshejh]

Kolawale,

  Thank you very much for your response below.  I was able to wait for the Servers to all slowdown after approximately 3 days.  I performed a few different tests, and I was not successful at pinpointing the exact feature that is causing the problem.  What I tried is outlined below.  I am certainly open to trying any other suggestions that you or others may have.  Thanks again, and please also let me know if you see something that I may not have tried correctly.  Thanks!

1.) I unregistered the clients on the Server from the Fortigate.  This "defaults" the Forticlient to its local settings for items such as Web Filtering and Application Firewall.  There was no change in the performance of the Server.

2.) Next, I disabled each feature one by one locally (Anitvirus, Web Filter, and Firewall was disabled without a registered fortigate).  I performed this same process on the two virtual servers and their host.  There was NO change in performance.

3.) I open Task Manager on one of the Servers and tried to end the process on all running "forti" processes.  Obviously, this did not do anything, as they simply restart themselves immediately.

4.)  Finally, I shut down the FortiClient on each server and then restarted FortiClient.  This is the only thing that returned the performance of the servers and network.

5.) Between each test, I copied and pasted the same large file from a local drive to a network location and then copied it back again.  The copy speed was used as my baseline for the server performance.

  Thanks, and please let me know your thoughts and other things that I may need to try.  Thanks again!

Thanks,

-foshejh

[kolawale_FTNT]

You may want to report this to Fortinet support. A Support Engineer will work with you to try to narrow down what is causing this. Sometimes they may find an issue in FortiClient that requires a solution. Other times, they offer suitable workarounds.

[foshejh]

Kolawale,

  Thank you again for your help on this.  I will open a support ticket now.  Do you (and can you) recommend that I request any Fortinet Team Member in particular to help solve this?  I don't think this is going to be a simple one, and I hate to waste a few technician's time if I can start with the right/best person to help resolve this issue.  Thanks again!

Thanks,

-John Foshee

[kolawale_FTNT]

Post the ticket number here after it has been created.

[foshejh]

Thanks again for all of your help on this.  The ticket number is 1472744.  I listed the other information below as well.  Thanks!!!

Ticket#Product SNSubjectStatusCreation DateClose DatePriorityRequest TypeSolution1472744FW60DP46130*****FortiClient Slowing Down Servers Over Time (CB reqeusted for Aug 8th)Researching2015-08-01N/AP3Technical Assistance

Thanks,

-foshejh

[foshejh]

To All,

  As an update, the Fortinet support team was able to help us narrow down the problem to the Application Firewall.  I left the FortiClients unregistered from the Fortigate for several days, and we did not see any slow down in performance, as we had seen previously.  Therefore, I was able to change the XML configuration of the servers and disable the Application Firewall when registered to the Fortigate.  This is serving as a temporary "repair" until Fortinet can work through the bug with FortiClient.

  A few other comments as well.  We tried to upgrade from 5.2.3 to 5.2.4, but this did not resolve this issue.  I did have some other issues though, so we downgraded back to 5.2.3.  Also, I have noticed my local machine is also slowing down over time now...  Therefore, I will need to disable the Application Firewall on the XML for this machine as well...

  Please let me know if anyone has any other suggestions that we could try.  Thanks!!!

Thanks,

-foshejh

[DarrenM]

Disabling a feature you're paying for is not really a solution though.   We are having the same issue but with the web filter over VPN.   Dog slow.   Turn it off and it's normal speed.

[TysonIT]

Follow up to this thread. While researching a very high CPU use on our FG60D. This thread pointed me to the application filtering on the forticlient policy. I turned it off and CPU is now 1% instead of pegged at 99%.