How can i check what is causing CPU spike on my Fortigate 300D?

[abbas135]

I receive a SNMP trap of high CPU but by the time i log in to check the CPU is NORMAL -  below trap generating threshold(80%). 

How can i check what caused this spike in logs ?

[emnoc]

You can try to  run a few top to see what's running.

next,  use the time of the event and interface graph to see if a uptick of traffic is causing this

lastly, is this problem chronic or new?  How many hi-CPU do you get in a day? Hour ? Week ? Any patterns related to time-of-day or time-of-hour? Chasing a sporadic hiCPU might be fruitless.

Various things causes spikes of  hiCPU;

AV/IPS updates

heavy-explicit proxy

just loging in to the webGUI

backup task

excessive snmp pollers

etc....

Unless you had  hundreds per day, I would not  be too worried about a spike. Lastly if you suspect the platform is under-sized, you might need to upgrade to a bigger platform.

ken

[Toshi_Esumi]

You need to capture the moment and run "diag sys top" to see what's taking up most of CPU time at that time. It might not as easy as it sounds. You probably need to figure out how often it happens and when it mostlikely happens first.

http://kb.fortinet.com/kb/documentLink.do?externalID=FD30531

Despite the KB's description, you can use just lower-case 'm' or 'p' to change the sorting between memory and CPU usage.

[kurtli_FTNT]

Hi there,

    Below are  commands for resource diagnostic, FYI.

diag sys top-summary

get sys performance status

get sys performance top

Thanks