High Memory usage

[#1]

Hello, i have one question for a fortniet 50A Firewall. This one has always a hig memory usage of nearly 75-80 % memory usage. But on this one is only one vpn tunnel configured and just a few firewall policies. I don´t know why this one has such high memory usage. I have disabled all not needed features like some logging parameters and so on but the percentage still remains high. How could i check which process on the device causes the memory usage. Could anyone tell me how i could check it?! The firmware version on the device is 2.80 build 359,050210. Thanks. Christian

[#2]

I have a similar problem with a FGT-60, v2.80, build 250,040914 If I reboot the firewall, the memory usage will drop to about 60%. It will creep up marginally until it is now 73% after being up for 30 days. Any help would be greatly appreciated. Thanks, Tom

[#3]

In the case of a Fortigate 50, I believe that high memory usage is largely due to the limited ammount of RAM installed and the RAM-resident size of recent versions of FortiOS. It looks to me like this is only a real problem when Fortinet eventually releases a version of FortiOS that simply won' t run on a 50a because of RAM constraints, at which point you will be forced to ditch the 50a and purchase a model with more RAM. Or invalidate your warranty/support agreement by installing more RAM in the 50a, and then quite possibly run into CPU constraints. Or stick with down-versions of FortiOS. This seems to be just what happened with the original Fortigate model 50 (sans " A" ) sometime in recent months. My thoughts, worth exactly what you paid for them. 8^p

[#4]

As for the FGT-60 v2.80 build 250 040914, this sounds like what' s called a " memory leak" , where OS or application processes continue to allocate memory but don' t release it back to the pool when they' re done. Rebooting the fortigate puts things back to " square one" , so to speak, until RAM allocation creeps back up again. Two general observations: 1) each subsequent release of FortiOS is a little better with this issue 2) RAM allocation isn' t a real problem until it gets really high and causes hard malfunctions. So you have a couple of options: A) monitor Fortigate RAM usage and reboot the unit before memory creep causes real problems B) upgrade the FortiOS (after reviewing the release notes for items that might cause *real* problems for you) and hope that it helps

[#5]

If you have any type of logging enabled, I would guess that the logs are filling up your memory slowly. You could try to disable ALL logging and see if the memory still gets used up. I' m not sure if there is a way to clear the memory logs without rebooting.

[#6]

Is there any way to tell how much of the memory is being used by the logs? The logs fill up pretty quickly (a day or so). It seems the in-memory logs are limited to 128 entries each for the event, attack, anti-virus, web filter & spam filter. We have no web filters set up so they are not contributing to the memory utilization.

[#7]

A pragmatic way to approximate how much RAM is used by Fortigate log-to-memory - count the total number of characters (including spaces) across all five logs. Assuming ASCII and not unicode, that will be the number of bytes of RAM occupied by the logs. Since each log is limited to 128 lines and the number of characters per line can vary, the ammount of RAM used by logs will vary as the logs rotate. To flesh out a rough estimation of what to expect, we could assume 128 lines in each of the five logs (event, attack, anti-virus, web filter, and spam filter), and 500 characters per line.

128 lines
  X 5 logs
 X 500 chars-per-line
 -----------
 320,000 chars
 320 bytes
 312.5 kilobytes
 320 kibibytes

So you could free up something very roughly around 312KB of RAM by disabling log-to-memory, and log only to syslog/fortilog/fortireporter. Keep in mind that this is (a rough estimate of) the grand total maximum of how much RAM your logs will ever use, and that it won' t continuously creep up. That is, once all five logs have reached their max of 128 lines, their RAM usage is more-or-less maxed out and capped. The only fluctuation up or down will be due to longer or shorter log lines.

[#8]

I thought the FGT60 had 128MB of RAM. If your calcs are correct (and they seem reasonable), then the log files would take 320KB (0.32MB), which is negligible to the 128MB total. Over a 30-day period, I' m seeing the memory utilization rise from ~60% to >72%. That would equate to about 15MB (12% of 128MB). I can certainly understand that the logs would be contributing to some of the memory consumption, but what about the remainder. Is this due to " memory leaks" in the firmware?