FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
This article shows the improvements for the two most commonly user system resource debug CLI commands in FOS 5.4:
# get system performance status # diagnose system top
Solution
Monitor CPU, Memory and Network usage
The command now returns information about the iowait time (iowait), servicing interrupts time (irq) and servicing soft interrupts time (softirq) in % dedicated per CPU.
# get system performance status CPU states: 0% user 0% system 0% nice 100% idle 0% iowait 0% irq 0% softirq CPU0 states: 0% user 0% system 0% nice 100% idle 0% iowait 0% irq 0% softirq Memory states: 60% used Average network usage: 176/3kbps in 1 minute, 178/7 kbps in 10 minutes, 175/4 kbps in 30 minutes Average sessions: 19 sessions in 1 minute, 20 sessions in 10 minutes, 19 sessions in 30 minutes Average session setup rate: 0 sessions per second in last 1 minute, 0 sessions per second in last 10 minutes, 0 sessions per second in last 30 minutes Virus caught: 0 total in 1 minute Uptime: 2 days, 2 hours, 58 minutes
Resource Usage
The CPU/memory usage of internal processes can be monitored with the following CLI command:
#diag sys top <delay> <max line> <num iterations>
The <num iterations> option is new in v5.4
Sample output:
Run Time: 5 days, 23 hours and 55 minutes 0U, 0N, 11S, 99I, 0WA, 0HI, 0SI; 994T, 468F
<process name> <proc id> <state> <CPU> <Memory> initXXXXXXXXXXX 1 S 0.1 1.2 newcli 567 R 0.1 1.0 pyfcgid 187 S 0.0 3.8 reportd 123 S 0.0 3.3 pyfcgid 191 S 0.0 3.3 pyfcgid 189 S 0.0 3.2 httpsd 155 S 0.0 3.0
The line below the run time shows CPU state percentages based on the interval since the last refresh.
U is % of time user space applications use CPU N is % of time niced user processes use CPU - new in v5.4 S is % of time system processes (or kernel processes) use CPU. I is % of idle time CPU. WA is % of time waiting for I/O completion - new in v5.4 HI is % of time servicing hardware interrupts - new in v5.4 SI is % of time servicing software interrupts - new in v5.4 ST is % of stolen time from this vm by the hypervisor - new in v5.4 T is the total FortiOS system memory in Mb. In the example, 994T means there are 994 Mb of system memory. F is free memory in Mb. In the example, 468F means there is 468 Mb of free memory.
