You can hit the letter S for the highest CPU and you can restart that application by killing the PID - Process ID diag sys kill 11 903 (9 or 11 will kill the PID and restart it 9 is safer 11 keeps no track of you killing it in logs so try 9 first then 11). usually the CPU will go back down. if it happens frequently then i would suggest installing a new Forti IOS image on the box no need to replace the box since these are software and not hardware related. for the most part.
CLI# diagnose sys top
Run Time: 13 days, 13 hours and 58 minutes
0U, 0S, 98I; 123T, 25F, 32KF
newcli 903 R 0.5 5.5
sshd 901 S 0.5 4.0
Where the codes displayed on the second output line mean the following:
- U is % of user space applications using CPU. In the example, 0U means 0% of the user space applications are using CPU.
- S is % of system processes (or kernel processes) using CPU. In the example, 0S means 0% of the system processes are using the CPU.
- I is % of idle CPU. In the example, 98I means the CPU is 98% idle.
- T is the total FortiOS system memory in Mb. In the example, 123T means there are 123 Mb of system memory.
- F is free memory in Mb. In the example, 25F means there is 25 Mb of free memory.
- KF is the total shared memory pages used. In the example, 32KF means the system is using 32 shared memory pages.
Each additional line of the command output displays information for each of the processes running on the FortiGate unit. For example, the third line of the output is:
newcli 903 R 0.5 5.5
- newcli is the process name. Other process names can include ipsengine, sshd, cmdbsrv, httpsd, scanunitd, and miglogd.
- 903 is the process ID. The process ID can be any number.
- R is the state that the process is running in. The process state can be:
o R running.
o S sleep.
o Z zombie.
o D disk sleep.
- 0.5 is the amount of CPU that the process is using. CPU usage can range from 0.0 for a process that is sleeping to higher values for a process that is taking a lot of CPU time.
- 5.5 is the amount of memory that the process is using. Memory usage can range from 0.1 to 5.5 and higher.
Interactive diagnose sys top commands
You can enter the following single-key commands when diagnose sys top is running.
- Press q to quit.
- Press c to sort the processes by the amount of CPU that the processes are using.
- Press m to sort the processes by the amount of memory that the processes are using.
Stopping running processes
You can use the following command to stop running processes:
diagnose sys kill
- signal can be any number but 11 is preferred because this signal sends output to the crashlog which can be used by Fortinet Support to troubleshoot problems.
- process id is the process ID listed by the diagnose sys top command.
For example, to stop the process with process ID 903, enter the following command:
diagnose sys kill 11 903