Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
rawbar
New Contributor

FortiOS CLI question

We are running an old version of FortiOS 4.3 (patch 6) with a known memory leak.  Obviously it needs to be updated.  In the meantime, once a month one of the network engineers was killing the rogue process to free up the memory.  He has since left the company and didn't document what the process was or how to kill it.  All I have is a Fortinet ticket #.

 

I connected to the CLI but the only CLI commands available (both via web and ssh) are config, get, show and exit.  I'm looking at the FortiOS Handbook CLI Reference for FortiOS 4.3 and is says the command I should use is "system performance top".  However "system" isn't valid (5499: Unknown action 0 Command fail.  Return code -1)

 

What might be the reason "system" isn't available?

 

2 Solutions
Christopher_McMullan

The general syntax for the CLI is verb-area-noun, so every command has to start with config, execute, get, show, or diagnose.

 

In this case, the command to view 'top' data as in Linux would be 'diag sys top'. You can also get a system performance snapshot with 'get sys perf stat'.

 

If 4.3.6 is suffering from merged_daemons, you would want to run 'diag sys top', and immediately press 'q' afterwards to generate one set of results. Find the process ID for merged_daemons (if that's truly the offending process - but from that build, it likely is), then run 'diag sys kill 11 <PID>'. For instance, if merged_daemons is running with a PID of 50, the command would be 'diag sys kill 11 50'.

 

The CLI reference guide, except for the bottom sections dealing with the commands beginning with the verbs 'get' and 'execute' all assume an initial verb of 'config'. That may be where the confusion was introduced: every section like 'alertemail...' or 'router....' assumes it begins with 'config'. So, for static routes, the document path would be router > static, but the full command would be 'config router static'.

Regards, Chris McMullan Fortinet Ottawa

View solution in original post

Christopher_McMullan

VDOMs...<foot inserted into mouth>

 

I can over-think things - I haven't seen that error come up when VDOMs are present and we don't enter the context of a VDOM first. That may explain why more tickets don't note the error as an issue.

 

Glad it's not something more serious.

Regards, Chris McMullan Fortinet Ottawa

View solution in original post

13 REPLIES 13
Christopher_McMullan

Okay...I think the best way forward is to open a ticket with Fortinet TAC to explore cluster issues. Explain your access limitations, and see what can be done short of immediately upgrading.

 

The solutions in the related tickets for HA clusters encountering the output you posted aren't consistent, so I can't provide a catch-all fix you could try without further analysis.

Regards, Chris McMullan Fortinet Ottawa

rawbar

OK!  For anybody else that runs into this.... I needed to first type:

 

config vdom

edit root

 

NOW diagnose is available to me.

Christopher_McMullan

VDOMs...<foot inserted into mouth>

 

I can over-think things - I haven't seen that error come up when VDOMs are present and we don't enter the context of a VDOM first. That may explain why more tickets don't note the error as an issue.

 

Glad it's not something more serious.

Regards, Chris McMullan Fortinet Ottawa

rawbar

Thanks again for the help.  In this case, the offending process was forticron.  Once I killed the process, I was then able to save config changes I'd been trying to make.  However the documented method of killing the offending process did not work for me.  

 

diag sys kill 11 <PID> gave me: "command parse error before 'kill'

 

I ended up killing the process with: fnsysctl kill -9 PID

 

 

Christopher McMullan_FTNT wrote:

VDOMs...<foot inserted into mouth>

 

I can over-think things - I haven't seen that error come up when VDOMs are present and we don't enter the context of a VDOM first. That may explain why more tickets don't note the error as an issue.

 

Glad it's not something more serious.

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors