1. Optimizing CPU usage
If you find the CPU usage is too high the following steps can help reduce your CPU load:
• Reduce session timers. Note that tcp-timewait has 10 seconds added by default.
config system global
set tcp-halfclose-timer 30 (default is 120 s)
set tcp-halfopen-timer 30 (default is 60 s)
set tcp-timewait-timer 0 (default is 120 s)
set udp-idle-timer 60 (default 120 s)
end

2. • Remove dns-udp firewall session helper (number 14) if not used.
• Do not enable non-required or “nice to have” features.
• Use hardware acceleration wherever possible.
• Avoid the use of GUI widgets that require computing cycles, such as the Top Sessions widget.

3. ‧ Use SNMP to monitor CPU usage.
‧ Use CLI commands to monitor CPU usage:
diagnose system session stat
get system performance status
diagnose system top
diagnose hardware sysinfo memory

4. diag sys top Sample output: Run Time: 13 days, 13 hours and 58 minutes
0U, 0S, 98I; 123T, 25F, 32KF
newcli 903 R
sshd 901 S
• U is % of user space applications using CPU. In the example, 0U means 0% of the user
space applications are using CPU.
• S is % of system processes (or kernel processes) using CPU. In the example, 0S
means 0% of the system processes are using the CPU.
• I is % of idle CPU. In the example, 98I means the CPU is 98% idle.
• T is the total FortiOS system memory in Mb. In the example, 123T means there are 123 Mb of system memory.
• F is free memory in Mb. In the example, 25F means there is 25 Mb of free memory.
• KF is the total shared memory pages used. In the example, 32KF means the system is using 32 shared memory pages.

5. newcli 903 R
Where:
• newcli is the process name. Other process names can include ipsengine, sshd,
cmdbsrv, httpsd, scanunitd, and miglogd.
• 903 is the process ID. The process ID can be any number.
• R is the current state of the process. The process state can be:
Rrunning
Ssleep
Zzombie
Ddisk sleep.
• 0.5 is the amount of CPU that the process is using. CPU usage can range from 0.0 for
a process that is sleeping to higher values for a process that is taking a lot of CPU time.
• 5.5 is the amount of memory that the process is using. Memory usage can range from
0.1 to 5.5 and higher.
Enter the following single-key commands when diagnose sys top is running:
• Press q to quit and return to the normal CLI prompt.
• Press p to sort the processes by the amount of CPU that the processes are using.
• Press m to sort the processes by the amount of memory that the processes are using.

6. diag hardware deviceinfo nic <interface>
System_Device_Name port5
Current_HWaddr 00:09:0f:68:35:60
Permanent_HWaddr 00:09:0f:68:35:60
Link up
Speed 100
Duplex full
[……]
Rx_Packets=
Tx_Packets=
Rx_Bytes=
Tx_Bytes=
Rx_Errors=0
Tx_Errors=0
Rx_Dropped=0
Tx_Dropped=0
[…..]

7. get sys performance status
CPU states: 0% user 0% system 0% nice 100% idle
Memory states: 10% used
Average network usage: 0 kbps in 1 minute, 0 kbps in 10 minutes,
13 kbps in 30 minutes
Average sessions: 31 sessions in 1 minute, 30 sessions in 10
minutes, 31 sessions in 30 minutes
Virus caught: 0 total in 1 minute
IPS attacks blocked: 0 total in 1 minute
Uptime: 44 days, 18 hours, 42 minutes

8. diag npu np4 list ID PORTS -- ----- 0 port1 0 port2 0 port3 0 port4

9. exec tac report
執行所有 diagnose 指令,提供完整檢查