Ferrite Guidance Hub Interactive Field Runbook #14
← All Runbooks Main Platform
Remote Ops · Kernel & Management Plane · Dual-Window Standard

High CPU Due to httpsd / forticron & Management Lockout Triage

Diagnose and resolve web GUI lockouts, unresponsive management ports, httpsd worker thread exhaustion in D-state, http_authd login hangs, and deploy live secondary SSH telemetry and Fortinet Support Tool browser traces.

RUNBOOK POSITION 14 OF 25 Remote Ops Management Plane ⚡ 7 Sources Synthesized

What this article covers

Step-by-step diagnostic and hardening workflow to isolate runaway web management workers, open a secondary SSH live debug stream, resolve FortiFlow resolve-apps CPU spikes, recycle hung authentication daemons, deploy kernel-level local-in-policy rules, and capture browser HAR logs via the Fortinet Support Tool.

Scope & Firmware Matrix: All FortiGate firewall models (FG-40F through FG-3700D series) running FortiOS 7.0.x, 7.2.x, 7.4.x, and 8.0.

Before using the CLI

Dataplane Blast Radius Confirm user transit traffic and IPsec tunnels continue forwarding normally through NP7/NP6 ASICs even while GUI CPU is pinned at 100%.
Dual-Window Setup Open two parallel terminal sessions: Window 1 for active configuration/triage, and Window 2 as a dedicated live SSH telemetry listener.
Fortinet Support Tool Install the official Fortinet Support Tool Chrome/Edge extension to record HTTP HAR and JS console logs during GUI reproduction.

Troubleshooting & Hardening Workflow

STEP 01

Isolate CPU consumption across node, httpsd and forticron workers

In Window 1, query the real-time process list. In FortiOS 7.2+, modern web GUI services run as node (NodeJS backend) alongside legacy httpsd workers. Identify whether CPU is consumed by node event loops, httpsd, or forticron, and detect workers in uninterruptible sleep (D state).

diagnose sys top 2 99
diagnose sys top-summary "sort=cpu"
# Inspect node and httpsd worker PIDs
STEP 02

Open Secondary SSH Window to collect httpsd debug during changes

Open a secondary SSH terminal session (Window 2) and enable real-time httpsd daemon logging with timestamps. Keep this window streaming while making changes in Window 1 to capture immediate proof in the logs whether setting changes resolved the issue or had no effect:

# [WINDOW 2 - SECONDARY SSH LIVE TELEMETRY LISTENER]
diagnose debug reset
diagnose debug application httpsd -1
diagnose debug console timestamp enable
diagnose debug enable

• Proof of Resolution: FortiFlow application query failed (-1) loop ceases, workers exit D-state, and clean HTTP handshakes appear.
• Proof of Ineffectiveness: If error messages continue uninterrupted, the tested setting change had no effect and can be safely reverted without guesswork.

STEP 03

Resolve FortiFlow query failure loop & D-state workers

If Window 2 debugs display repeated FortiFlow application query failed (-1) or workers stay pinned in D-state, disable GUI application resolution to immediately release the CPU lock.

# [WINDOW 1 - CONFIGURATION WORKAROUND]
config log gui-display
    set resolve-apps disable
end
STEP 04

Clear hung authentication daemons & audit alertconsole

If the login page loads but credential submission hangs indefinitely, inspect alertconsole events and recycle the HTTP authentication supervisor.

diagnose alertconsole list
fnsysctl killall http_authd
diagnose debug crashlog read
STEP 05

Execute graceful SIGTERM worker recycle & local-in-policy hardening

Rather than forceful SIGKILL, gracefully terminate hung node or httpsd workers using diagnose sys kill 15 <pid> so listening TCP sockets unbind cleanly without socket corruption. Use fnsysctl killall httpsd only for total worker pool deadlocks. Deploy strict Local-In Policy to drop external sweeps at the driver layer.

# Gracefully recycle specific hung worker PID:
diagnose sys kill 15 <pid>
# Fallback zero-downtime pool respawn:
fnsysctl killall httpsd
config firewall local-in-policy
    edit 1
        set intf "wan1"
        set srcaddr "AUTHORIZED_ADMIN_SUBNET"
        set dstaddr "all"
        set action accept
        set service "HTTPS" "SSH"
        set schedule "always"
    next
    edit 2
        set intf "wan1"
        set srcaddr "all"
        set dstaddr "all"
        set action deny
        set service "HTTPS" "SSH"
        set schedule "always"
    next
end
STEP 06

Capture browser HAR & console traces via Fortinet Support Tool

For GUI pages that fail to load completely or throw widget rendering errors, launch the Fortinet Support Tool browser extension in Chrome/Edge, start an incident recording, reproduce the page load, and export the diagnostic zip dossier for FortiCare.

# 1. Launch Chrome/Edge with Fortinet Support Tool extension
# 2. Click extension -> "Capture Incidents" -> Select active FortiGate tab
# 3. Reproduce GUI page failure -> Stop capture -> Download diagnostic .zip
# 4. In Window 2, cleanly teardown debug telemetry:
diagnose debug disable
diagnose debug reset
Operational Caution: Recycling the `httpsd` process via `fnsysctl killall httpsd` only restarts the administrative web server daemon. It does NOT reset firewall policies, drop active user transit sessions, or tear down IPsec tunnels, as dataplane forwarding is executed independently in hardware ASICs and kernel space. Always ensure diagnose debug disable is run when finished to prevent terminal buffer exhaustion.

Consolidated Technical References & Field Guidance