Woke up today and saw High CPU Usage

[romank]

Hello Everyone,

Todays morning wasnt as good as yesterday. I just have been triggered that FortiWeb 600D has high CPU usage and some services arent running. So I started SSH session to check basic debug commands and saw that "7402m 46.6   0 77.5 /bin/proxy" <--- this process was taking most of CPU load peak were to 90%. Im wonder what could be the issue. There was no high traffic, a few hundreds of sessions which nothing for this WAF model.

Lastly I did software upgrade  from 7.0.x to 7.0.10 so it wasnt big upgrade. Im not sure if there is a bug in this version, release note didnt mentioned anything that would indicate problems with proxy process or high cpu usage. So I started to disable security profiles - "cookie security" and suddenly CPU load dropped to few %. Do you have some advice how to troubleshoot it further? what commadns are useful? 

[AEK]

Hi Romank

Hope this helps:

https://docs.fortinet.com/document/fortiweb/7.4.2/troubleshooting-guide/296153/checking-cpu-informat...

[romank]

im still investigating it. ProxyD seems to consume a lots of CPU resources. I did kill process i helped for a few minutes..  

These are the most:

11657 1 root S 3813m 24.0 3 3.2 /bin/proxyd
3816 3736 root S 2214m 13.9 2 2.6 /bin/mysqld --defaults-file=/data/etc/mysql/my-fortiweb.cnf --skip-grant-tables --user=root

[AEK]

Hi Romank

On my FWB the two mentioned processes consume no more than 1%.

I don't know what is proxyd (maybe the reverse proxy daemon?), while I guess the "mysqld my-fortiweb.cnf" is the FWB's internal DB.

In such case I'd do as you did, I mean disable feature by feature to try find which one is consuming CPU.

If this doesn't work then I'd open a ticket.

Just in case the FWB is not under support contract, I'd then backup the config, factory reset, then restore the config.

[shafiq23]

Hello romank,

You could use "diagnose system top delay 1" and press 1 on the keyboard to verify which CPU core is busy. "diagnose system perf top" tells you about functions being used across all CPUs.

Thanks.

Regards,
Shafiq