FortiOS CLI question

[rawbar]

We are running an old version of FortiOS 4.3 (patch 6) with a known memory leak.  Obviously it needs to be updated.  In the meantime, once a month one of the network engineers was killing the rogue process to free up the memory.  He has since left the company and didn't document what the process was or how to kill it.  All I have is a Fortinet ticket #.

I connected to the CLI but the only CLI commands available (both via web and ssh) are config, get, show and exit.  I'm looking at the FortiOS Handbook CLI Reference for FortiOS 4.3 and is says the command I should use is "system performance top".  However "system" isn't valid (5499: Unknown action 0 Command fail.  Return code -1)

What might be the reason "system" isn't available?

[Christopher_McMullan · Accepted solution]

The general syntax for the CLI is verb-area-noun, so every command has to start with config, execute, get, show, or diagnose.

In this case, the command to view 'top' data as in Linux would be 'diag sys top'. You can also get a system performance snapshot with 'get sys perf stat'.

If 4.3.6 is suffering from merged_daemons, you would want to run 'diag sys top', and immediately press 'q' afterwards to generate one set of results. Find the process ID for merged_daemons (if that's truly the offending process - but from that build, it likely is), then run 'diag sys kill 11 <PID>'. For instance, if merged_daemons is running with a PID of 50, the command would be 'diag sys kill 11 50'.

The CLI reference guide, except for the bottom sections dealing with the commands beginning with the verbs 'get' and 'execute' all assume an initial verb of 'config'. That may be where the confusion was introduced: every section like 'alertemail...' or 'router....' assumes it begins with 'config'. So, for static routes, the document path would be router > static, but the full command would be 'config router static'.

[Christopher_McMullan]

Okay...I think the best way forward is to open a ticket with Fortinet TAC to explore cluster issues. Explain your access limitations, and see what can be done short of immediately upgrading.

The solutions in the related tickets for HA clusters encountering the output you posted aren't consistent, so I can't provide a catch-all fix you could try without further analysis.

[rawbar]

OK!  For anybody else that runs into this.... I needed to first type:

config vdom

edit root

NOW diagnose is available to me.

[Christopher_McMullan · Accepted solution]

VDOMs...<foot inserted into mouth>

I can over-think things - I haven't seen that error come up when VDOMs are present and we don't enter the context of a VDOM first. That may explain why more tickets don't note the error as an issue.

Glad it's not something more serious.

[rawbar]

Thanks again for the help.  In this case, the offending process was forticron.  Once I killed the process, I was then able to save config changes I'd been trying to make.  However the documented method of killing the offending process did not work for me.  

diag sys kill 11 <PID> gave me: "command parse error before 'kill'

I ended up killing the process with: fnsysctl kill -9 PID

Christopher McMullan_FTNT wrote:

VDOMs...<foot inserted into mouth>

I can over-think things - I haven't seen that error come up when VDOMs are present and we don't enter the context of a VDOM first. That may explain why more tickets don't note the error as an issue.

Glad it's not something more serious.