Getting high CPU snmp alarms

[gradius85]

Folks,

I am using the default snmp values, since I just enabled snmp; however, I randomly get high cpu alarms throughout the day. Traffic transiting the firewall is low, so I am not sure why I would receive an alarm. Has anyone seen this?

[HaTiMuX]

When you get a new alarm, connect to your fortigate and check which process is causing high CPU (diag sys top),

then depending on which process you can decide what action to take to correct the problem if there is any.

[gradius85]

HaTiMuX wrote:

When you get a new alarm, connect to your fortigate and check which process is causing high CPU (diag sys top),

then depending on which process you can decide what action to take to correct the problem if there is any.

Thank you... Did the following, but didn't see anything. Maybe by the time I logged in the process or processes was completed. Is there a way or method to log 'top' to catch what processes is causing the issue? I am not even sure if I have an issue or if the snmp metric is by default too low.

[HaTiMuX]

Yes I think you should check the snmp metric first.

You can connect to you you fortigate using putty and save the output to a file:

Session -> Logging -> All session output

The "diag sys top" command is refreshing every 5 seconds by default, but you can change it, for example:

diagnose sys top 2 50 (refresh every 2 seconds and display 50 processes)

Otherwise, you can ask Fortinet Support for a monitoring script which can be used with Tera Term and it allows you to save the output of many commands to a file.

Here is a Fortinet KB on how to use the monitoring script:

https://kb.fortinet.com/kb/documentLink.do?externalID=FD47579