High CPU with V3 MR3

[#1]

Hi guys, I have a 3600 box and I recently upgraded from V2.8 MR11 to V3 MR3. The box was stable for more than 1 week but it recently booted and I' ve been noticing high cpu utilization, even with box practically doing nothing (no profile been used, the box is just working as a simple firewall) antispam, antivirus & IPS are shut off. Before opening a ticket with fortigate I wanted to share my experience here, any comments? regards.. Silvio

[#2]

Dear Silvio, I have the same problem with a fortigate 800 cpu is on 99 %cpu usage Do you have any response with fortinet?? Can you help me to solve this problem? Zeezar

[flow]

I had the same Problem with my Fortigate-800 3.00,build0479. CPU was between 95% and 99% for a couple of hours. miglogd was incomprehensibly using the whole CPU . after i killed the miglogd-process from cli, the process started again and the CPU usage was " normal" .

[romanr]

I can see the same problems once in a while with a FGT800 Cluster. Sometimes its the ipsd that comsumes up all the cpu and sometimes the miglod (esp when logdisk nearly full). Killing those processes normally get the devices to resume with operation as they should.

[cckwokho]

Dear all, Our Fortigate-800 cluster also faces the same problem recently. Would you mind telling me how the problem was fixed eventually? Thanks a lot.

[romanr]

With newer software versions I haven' t seen these issues anymore. Like Mr5P4 or MR6!

[rwpatterson]

If it' s chronic, look into ' Log&Report > Report Access > Memory' . It was here I found a DNS loop where the firewall was relaying DNS from the DNS server. Kept the CPU quite high, though not 99%. I shut off DNS forwarding to solve my problem... Other anomalies may present themselves here as well, if traffic related.

[cckwokho]

Dear romanr, We are using MR3 patch 9. Are MR5 p4 / MR6 stable? Dear rwpatterson, When the problem occurs, we run ' diag sys top' and find that ipsengine takes up 99% of cpu. Restarting the ipsengine solved the problem. Thanks a lot.

[#9]

Same is happening to me with a fortigate 800 v3. MR6, ipsengine takes lots of cpu going up to 90% or more , and after some hours goes down by itself. How do you restart the ipsengine?, Does affect the usage of the unit?

[romanr]

Hi, with MR5P4 I encountered only 1 minor bug in the dhcp relay function (only 1 dhcp relay server possible!), which is bugfix-pending with Fortinet. Everything else works the way it should. With a 3600 I' d go the MR5P4 and wait a bit with MR6. cheers.roman