Yes I think you should check the snmp metric first.
You can connect to you you fortigate using putty and save the output to a file:
Session -> Logging -> All session output
The "diag sys top" command is refreshing every 5 seconds by default, but you can change it, for example:
diagnose sys top 2 50 (refresh every 2 seconds and display 50 processes)
Otherwise, you can ask Fortinet Support for a monitoring script which can be used with Tera Term and it allows you to save the output of many commands to a file.
Here is a Fortinet KB on how to use the monitoring script: