My received rate does not match my forwarding rate.
Followed this but didn't work: https://community.fortinet.com/t5/FortiAnalyzer/Technical-Tip-How-to-configure-and-troubleshoot-Log-...
VM:
google cloud stardard 16 CPU 32 G Memory
Faz:
version: v6.0.9-build0457
=> execute top
top - 20:19:11 up 306 days, 22:41, 0 users, load average: 1.40, 1.54, 1.62
Tasks:305 total, 1 running,304 sleeping, 0 stopped, 0 zombie
%Cpu(s): 5.4 us, 4.1 sy, 0.0 ni,88.7 id, 0.7 wa, 0.0 hi, 1.0 si, 0.1 st
MiB Mem :32198.66+total, 374.613 free,6002.246 used,25821.80+buff/cache
MiB Swap:32197.99+total,21635.76+free,10562.23+used.24563.62+avail Mem
1477 root 20 0 2563.3m 642.5m 60.3 2.0 266186:17 S /bin/logfwd
22843 root 20 0 3685.2m 1.334g 44.4 4.2 313449:29 S /bin/sqllogd
1476 root -13 0 2663.0m 1.137g 28.8 3.6 200587:04 S /bin/fortilogd
6293 root 20 0 2853.9m 664.3m 26.5 2.1 9533:51 S /bin/oftpd
668 root 20 0 0.0m 0.0m 2.6 0.0 9008:01 S [jbd2/dm-0-8]
6544 root 20 0 0.0m 0.0m 1.7 0.0 0:00.90 S [kworker/u32:0]
943 root 20 0 48.5m 10.3m 1.3 0.0 5556:37 S /bin/redis-server+
1482 root 20 0 15.475g 324.2m 1.0 1.0 5849:56 S /bin/logfiled
782 root 20 0 227.1m 15.5m 0.7 0.0 1621:23 S /bin/cmdbsvr
2267 root 20 0 17.6m 2.5m 0.7 0.0 0:00.03 R /bin/top
7 root 20 0 0.0m 0.0m 0.3 0.0 948:03.96 S [rcu_sched]
19 root 20 0 0.0m 0.0m 0.3 0.0 3:50.04 S [ksoftirqd/3]
81 root 20 0 0.0m 0.0m 0.3 0.0 3990:57 S [kswapd0]
407 root 0 -20 0.0m 0.0m 0.3 0.0 27:34.82 S [kworker/2:1H]
1138 root 20 0 811.0m 14.0m 0.3 0.0 1226:50 S dmserver
1483 root 20 0 806.4m 11.3m 0.3 0.0 228:22.79 S /bin/uploadd
=> execute iotop
FAZVM64-GCP # execute iotop
Total DISK READ :^[?7h^[0.00 B/s | Total DISK WRITE :98.73 M/s
Actual DISK READ:0.00 B/s | Actual DISK WRITE:14.10 M/s
H0.00 B/s 0.00 B/s 0.00 % 0.00 % [kthreadd]XXXXXXXXXX7m IO> COMMAND
H0.00 B/s 0.00 B/s 0.00 % 0.00 % [ksoftirqd/0]
H0.00 B/s 0.00 B/s 0.00 % 0.00 % [kworker/0:0H]
H0.00 B/s 0.00 B/s 0.00 % 0.00 % [rcu_sched]NO_DETACH
H0.00 B/s 0.00 B/s 0.00 % 0.00 % [rcu_bh]
H0.00 B/s 0.00 B/s 0.00 % 0.00 % [migration/0]
H0.00 B/s 0.00 B/s 0.00 % 0.00 % [migration/1]
H0.00 B/s 0.00 B/s 0.00 % 0.00 % [ksoftirqd/1]
H0.00 B/s 0.00 B/s 0.00 % 0.00 % [kworker/1:0]
H0.00 B/s 0.00 B/s 0.00 % 0.00 % [kworker/1:0H]
H0.00 B/s 0.00 B/s 0.00 % 0.00 % [migration/2]
H0.00 B/s 0.00 B/s 0.00 % 0.00 % [ksoftirqd/2]
H0.00 B/s 0.00 B/s 0.00 % 0.00 % [kworker/2:0H]
H1.268M/s 0.00 B/s 0.00 % 0.00 % [migration/3]^[15A^[L^[L^[L^[L
H5 % sqllogd [~logd.wk
H05% redis-ser~0.0.1:63802
H54.16^[L^[L^[L32 M/s 0.00 % 0.00 % fortilogd~ogd.wrtr3] % fortilogd~ogd.wrtr1]
H40 % fortilogd~ogd.wrtr0]
H3 % logfwd [l~.Loader-P
H0.00 B/s 2019.32 B/s 0.00 % 0.00 % cpumemond
Hsqllogd [~logd.wkr2s 0.00 % 0.00 % sqllogd [~logd.wkr1]
H0.28.83 K/s 1920.72 K2^[16A^[M^[M
H13 % sqllogd [~logd.wk
H0 0.00 B/s 2.08 M2
H 2.66 M~conf -f upconf2
Hfortilogd~ogd.wrtr0 M
H0.00 B/s 0.00 B/s 0.00 % 0.00 % [ksoftirqd/1]
H3148.51s 0.00 B/s 0.00 % 0.00 % [kworker/1:0]^[13A^[L^[L
H74.26 K -~slogd.conf63801
H3.62.5rt/4 root 2001.02 K/s 1915.04 K/s1 0.00 % 0.00 % fortilogd~ogd.wrtr0]
H91^[9B2 K62^[10A^[M^[M
213
H63 % [jbd2/dm-0-8].wrtr3]
H3.00 Bworker/u32:0] ]
H0.00 B/s 0.00 B/s 0.00 % 0.00 % [ksoftirqd/1]
H21.21B/s 0.00 B/s 0.00 % 0.00 % [kworker/1:0]^[14A^[M^[M^[M
H1711.78llogd [~logd.wkr1
H00802
H20.15ortilogd~ogd.wrtr1]
H0.00 B/s 0.00 B/s 0.00 % 0.00 % [kworker/1:0H]
H0.00 B/s 0.00 B/s 0.00 % 0.00 % [migration/2]
H^[?1ll^> 0.00 B/s 0.00 % 0.00 % [ksoftirqd/2]^[?1l^>
=> get system performance
CPU:
Used: 8.03%
Used(Excluded NICE): 8.03%
%used %user %nice %sys %idle %iowait %irq %softirq
CPU0 13.60 2.19 0.00 1.97 86.40 0.00 0.00 9.43
CPU1 3.30 1.03 0.00 1.24 96.70 0.00 0.00 1.03
CPU2 15.10 5.31 0.00 6.94 84.90 2.45 0.00 0.41
CPU3 7.92 2.71 0.00 5.21 92.08 0.00 0.00 0.00
CPU4 10.33 6.40 0.00 3.10 89.67 0.62 0.00 0.21
CPU5 3.72 1.45 0.00 1.86 96.28 0.41 0.00 0.00
CPU6 6.37 1.44 0.00 2.46 93.63 2.26 0.00 0.21
CPU7 5.32 2.25 0.00 2.66 94.68 0.20 0.00 0.20
CPU8 8.39 3.77 0.00 4.61 91.61 0.00 0.00 0.00
CPU9 4.71 2.46 0.00 2.25 95.29 0.00 0.00 0.00
CPU10 9.84 2.66 0.00 3.28 90.16 3.89 0.00 0.00
CPU11 3.73 2.07 0.00 1.66 96.27 0.00 0.00 0.00
CPU12 8.25 6.19 0.00 2.06 91.75 0.00 0.00 0.00
CPU13 9.71 4.13 0.00 5.17 90.29 0.21 0.00 0.21
CPU14 13.99 4.12 0.00 5.97 86.01 3.50 0.00 0.41
CPU15 5.71 2.86 0.00 2.65 94.29 0.00 0.00 0.20
Memory:
Total: 65,942,184 KB
Used: 18,352,552 KB 27.8%
Total (Excluding Swap): 32,971,436 KB
Used (Excluding Swap): 7,660,580 KB 23.2%
Hard Disk:
Total: 1,047,343,256 KB
Used: 466,020,672 KB 44.5%
Inode-Total: 4,096,000 KB
Inode-Used: 147,548 KB 3.6%
IOStat: tps r_tps w_tps r_kB/s w_kB/s queue wait_ms svc_ms %util sampling_sec
241.2 92.9 148.3 20369.5 56124.8 0.0 0.1 2.0 15.5 25907806.04
Flash Disk:
Total: 499,656 KB
Used: 110,176 KB 22.1%
Inode-Total: 32,768 KB
Inode-Used: 35 KB 0.1%
IOStat: tps r_tps w_tps r_kB/s w_kB/s queue wait_ms svc_ms %util sampling_sec
0.0 0.0 0.0 0.0 0.0 0.0 0.8 0.5 0.0 25907806.14
=> diagnose debug sysinfo
collecting information with interval=3 seconds...
=== file system information ===
Filesystem 1K-blocks Used Available Use% Mounted on
rootfs 16441992 270532 16171460 2% /
none 16442004 0 16442004 0% /dev
none 32384872 20 32384852 0% /dev/shm
none 65536 44 65492 0% /tmp
/dev/sda1 499656 110176 389480 22% /data
/dev/mdvg/mdlv 1047343256 466377932 580948940 45% /var
/dev/mdvg/mdlv 1047343256 466377932 580948940 45% /drive0
/dev/mdvg/mdlv 1047343256 466377932 580948940 45% /Storage
/dev/loop0 8887 97 8278 1% /var/dm/tcl-root
none 1048576 0 1048576 0% /drive0/tmp/sql_bat
none 131072 0 131072 0% /drive0/private/dbcommit
=== /tmp system information ===
-rw-r--r-- 1 root root 271 Jun 1 15:52 LOG_BYPASS_COLS__10_0
srwxrwxrwx 1 root root 0 Jan 23 2023 alertd.req
srw-rw-rw- 1 root root 0 Jan 23 2023 alertmail.sock
srw-rw-rw- 1 root root 0 Jan 23 2023 alertmail_workflow.sock
-rw-rw-rw- 1 root root 4 Jan 23 2023 cmdb_lock
srwxrwxrwx 1 root root 0 Jan 23 2023 cmdbsocket
-rw------- 1 root root 35 Nov 26 20:13 con_login
-rw-r--r-- 1 root root 328 Nov 26 09:39 crontab
-rw-r--r-- 1 root root 0 Jan 23 2023 crontab.lock
srw-rw-rw- 1 root root 0 Jan 23 2023 ddmclt.sock
-rw-r--r-- 1 root root 4 Jan 23 2023 django.pid
-rw-r--r-- 1 root root 0 Jan 23 2023 dvm_sync_init
-rw-r--r-- 1 root root 8 Nov 26 20:24 dvm_timestamp
drwx------ 2 root root 40 Jan 23 2023 dynamic
-rw-r--r-- 1 root root 0 Jan 23 2023 faz.dbtrim.mutex
srwxr-xr-x 1 root root 0 Apr 26 2023 faz_svc
srwxr-xr-x 1 root root 0 Jan 23 2023 fazwatchd_event
srwxr-xr-x 1 root root 0 Jan 23 2023 fcgi.sock
srwxr-xr-x 1 root root 0 Jan 23 2023 fmgd.domain
-rw-r--r-- 1 root root 7 Nov 26 09:50 fortilogd_status.txt
srwxr-xr-x 1 root root 0 Jan 23 2023 httpcli.msg
srw-rw-rw- 1 root root 0 Jan 23 2023 hwmond.req
srwxr-xr-x 1 root root 0 Jan 23 2023 internal_logfwd_path
prw-r--r-- 1 root root 0 Jan 23 2023 keepalived.fifo
srwxr-xr-x 1 root root 0 Jan 23 2023 log_stat.svr
srwxr-xr-x 1 root root 0 Nov 3 11:22 logcluster_hub_path
srwxr-xr-x 1 root root 0 Jan 23 2023 logcluster_local_path
-rw------- 1 root root 0 Jan 23 2023 miglog_client.lock
-rw------- 1 root root 0 Jan 23 2023 miglog_server.lock
-rw------- 1 root root 0 Feb 1 2023 miglog_viewer.lock
drw-r--r-- 2 root root 40 Nov 3 11:22 oftpd
drwxr-xr-x 2 root root 40 Nov 20 03:00 rpt_status
srwxr-xr-x 1 root root 0 Jan 23 2023 sql_plugin
srwxr-xr-x 1 root root 0 Jan 23 2023 sql_report
srwxr-xr-x 1 root root 0 Jan 23 2023 sqlite
-rw-r--r-- 1 root root 1 Jan 23 2023 sqlplugin_init_flag
srw-rw-rw- 1 root root 0 Jan 23 2023 srchd.sock
srwxr-xr-x 1 root root 0 Jan 23 2023 syncsched
-rw-r--r-- 1 root root 48 Jan 23 2023 upgrade_process.txt
=== resource use information ===
Program uses most memory: [/bin/sqllogd], pid 22843, size 1365m
Program uses most cpu: [/bin/sqllogd], pid 22843, percent 73%
=== db locks information ===
