Description
This article describes how to create the following automation stitches. Automation stitches can be created to run a CLI script and send an email message when the CPU exceeds specified thresholds.
Scope
FortiGate.
Solution
To define CPU and memory usage thresholds:
config system global
set cpu-use-threshold <percent>
end
In the above, 'cpu-use-threshold' is the threshold at which CPU usage is reported, in the percentage of total possible CPU utilization (default = 90).
Create an automation action to run a CLI script:
For FortiOS v6.4 or earlier:
config system automation-action
edit "high_cpu_debug"
set action-type cli-script
set required enable
set script "diagnose debug cli 8
get system performance status | grep 'CPU s\|^Average'
diagnose sys profile report
diagnose sys mpstat 1 5
diagnose sys top 1 5 5
next
end
For FortiOS v7.0 and above:
config system automation-action
edit "high_cpu_debug"
set action-type cli-script
set script "diagnose debug cli 8
get system performance status | grep 'CPU s\|^Average'
diagnose sys profile report
diagnose sys mpstat 1 5
diagnose sys top 1 5 5
next
end
Create an automation action to send an email:
For FortiOS v6.4 or earlier:
config system automation-action
edit "auto_high_cpu_email"
set action-type email
set email-to "person@fortinet.com"
set email-subject "CSF stitch alert: high_cpu"
set email-body "%%results%%"
next
end
For FortiOS v7.0 and above:
config system automation-action
edit "auto_high_cpu_email"
set action-type email
set email-to "person@fortinet.com"
set email-subject "CSF stitch alert: high_cpu"
set message "%%results%%"
next
end
Create an automation trigger:
config system automation-trigger
edit "auto_high_cpu"
set event-type high-cpu
next
end
Create an automation stitch:
For v7.0 and earlier:
config system automation-stitch
edit "auto_high_cpu"
set trigger "auto_high_cpu"
set action "high_cpu_debug" "auto_high_cpu_email"
next
end
For v7.2 and above:
config system automation-stitch
edit "auto_high_cpu"
set trigger "auto_high_cpu"
config actions
edit 1
set action "high_cpu_debug"
set required enable
next
edit 2
set action "auto_high_cpu_email"
set required enable
next
end
next
end
Once the CPU reaches the threshold, an email will be received.
Related article:
Technical Tip: Use FortiGate automation stitches for alert emails
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2025 Fortinet, Inc. All Rights Reserved.