FortiSwitch - High CPU usage

[dcbz123]

Hi all,

I have peaks of high CPU usage on the FortiSwitches FS-248E model. Theses FortiSwitch are in modo fortilink.

The event is the following: 

How can I lower CPU usage? Currently very few customer traffic.

Thanks,

[Christian_89]

Hello

High CPU usage on FortiSwitches can be caused by various factors, including network congestion, software bugs, or misconfigurations. Here are a few steps you can take to lower the CPU usage:

1. Update Firmware: Ensure that your FortiSwitches are running on the latest firmware version. Software updates often include bug fixes and performance improvements that can help reduce CPU usage.

2. Monitor Traffic: Use monitoring tools to analyze network traffic and identify any abnormal patterns or sources of congestion. Excessive traffic can strain the FortiSwitch CPU, so identifying and resolving congestion issues can help lower CPU usage.

3. Check Configuration: Review the configuration of your FortiSwitches and ensure that it aligns with your network requirements. Look for any misconfigurations or unnecessary features enabled that may be causing additional CPU load. Consider optimizing the configuration based on best practices provided by Fortinet.

4. Disable Unused Features: Disable any unused features or services on the FortiSwitch that are not required for your network operations. This can help reduce unnecessary CPU usage.

5. Troubleshoot Network Devices: Check if there are any network devices connected to the FortiSwitches that might be causing excessive traffic or generating unnecessary network requests. Troubleshoot and address any issues with these devices.

6. Contact Fortinet Support: If the issue persists or if you suspect a software bug, consider reaching out to Fortinet support for further assistance. They can provide specific guidance based on your environment and help troubleshoot the high CPU usage problem.

Remember to monitor the CPU usage over time to ensure that the steps you take are effective in reducing the CPU load.

[dcbz123]

Thanks Cristian. We have noticed that in high CPU usage spikes the process with the highest % is lldpmedd.

Is it normal for this process to consume so much CPU? Currently, the user ports have an lldp profile assigned for the automatic assignment of the voice vlan. Currently very few users connected.

What configuration can I review associated with lldpmedd? 

[laltuzar]

What's the FortiSwitch version running right now? The LLDP process should not consume this amount of CPU. Maybe a reset to the process might help as a workaround, however this might be a behavior that needs to be investigated or has been fixed on an earlier firmware.

[dcbz123]

The FortiSwitchOS is 7.2.3. I'm going to restart the process and see the behavior.

These CPU spikes are short-lived, however they occur constantly.

thanks,

[dcbz123]

Hi,

I have restarted the lldpmedd process, however the high CPU event continues.

I have also seen, that when making a configuration change (Ex. Edit a port) from the Switch-controller (Fortigate), the high CPU event is also displayed.

Thanks,

[laltuzar]

Thanks for your reply.

At this point we might need to check if there is a problem on this switch specifically. For that, please open a new ticket with the serial number:

• Create a ticket through the Support Portal at https://support.fortinet.com

•Call us at one of the numbers listed at https://www.fortinet.com/support/contact.html

•Use the Chat Service which can be found at https://www.fortinet.com/support/contact.html  

Please attach the result of the following command "diagnose debug report" from the FortiSwitch.  You can use this KB to perform this operation: 

https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-create-a-log-file-of-a-session-usin...

[cardine]

Was curious if this ever solved as we are experiencing the same issues we tried upgrading to the latest version 7.4.2 and still see spikes up to 95% sustained every 1.5 hours. We started eliminating service (SNMP, IP Conflict Detections, and LLDP-MED but it still remains.