The FMG/FAZ Performance Monitor is a Python script that collects FortiManager and FortiAnalyzer performance information through the JSON API and displays it in a continuously refreshed terminal dashboard.

The project is available on GitHub: FMG/FAZ Performance Monitor.

What the Script Monitors

The script displays:

• Overall and per-core CPU usage
• CPU usage excluding NICE processes
• Memory utilization
• Hard-disk and flash-disk usage
• Disk I/O, queue, throughput, TPS, wait time, and service time
• FortiAnalyzer receive and insert log rates
• FortiAnalyzer log-forwarding status
• Top CPU-consuming processes
• Top disk-I/O-consuming processes
• Warning and critical health indicators

It supports both FortiManager and FortiAnalyzer and automatically detects the connected platform.

How It Works

When the script starts, it:

1. Reads the URL, API key, SSL setting, and refresh interval from config.ini.
2. Calls sys/status/ to detect FortiManager or FortiAnalyzer.
3. Runs the applicable API requests.
4. Parses and normalizes the returned data.
5. Displays the results in a terminal dashboard.
6. Refreshes the information at the configured interval.

The performance requests are executed concurrently using Python’s ThreadPoolExecutor, which reduces the dashboard refresh time.

with ThreadPoolExecutor(max_workers=5) as executor:
    tasks["cli_perf"] = executor.submit(
        fetch_api_data,
        url,
        api_key,
        build_cli_perf_body(),
        verify_ssl,
        timeout
    )

    if platform == "FAZ":
        tasks["faz_perf"] = executor.submit(
            fetch_api_data,
            url,
            api_key,
            build_faz_perf_body(),
            verify_ssl,
            timeout
        )

        tasks["log_forward"] = executor.submit(
            fetch_api_data,
            url,
            api_key,
            build_log_forward_body(),
            verify_ssl,
            timeout
        )

API Calls Used

All requests are sent to:

https://<FMG_OR_FAZ>/jsonrpc

1. Platform Detection

API URL

sys/status/

This request identifies whether the target is FortiManager or FortiAnalyzer.

{
  "method": "get",
  "params": [
    {
      "url": "sys/status/"
    }
  ],
  "verbose": 1,
  "id": 1
}

The script checks the returned Platform Type value:

if "fortimanager" in platform_text or "fmg" in platform_text:
    platform = "FMG"
elif "fortianalyzer" in platform_text or "faz" in platform_text:
    platform = "FAZ"

FortiAnalyzer-specific requests are skipped when FortiManager is detected.

2. System Performance

API URL

/cli/global/system/performance

This is the main performance API for both FortiManager and FortiAnalyzer.

{
  "id": "4",
  "method": "get",
  "params": [
    {
      "url": "/cli/global/system/performance"
    }
  ]
}

It provides:

• Overall CPU usage
• Per-core CPU usage
• User, system, NICE, idle, and I/O-wait CPU values
• Total and used memory
• Hard-disk and flash-disk usage
• Disk I/O utilization
• Disk queue
• Read and write throughput
• Transactions per second
• Wait and service time

Per-core CPU entries are located using a regular expression:

match = re.match(r"CPU\[(\d+)\] usage", str(key))

if match:
    core_index = int(match.group(1))
    usage = value.get("Usage")

This helps identify cases where one CPU core is heavily utilized even when the overall CPU average appears normal.

3. FortiAnalyzer Performance

API URL

/fazsys/monitor/system/performance/status

This request is only used for FortiAnalyzer.

{
  "id": "3",
  "jsonrpc": "2.0",
  "method": "get",
  "params": [
    {
      "url": "/fazsys/monitor/system/performance/status",
      "apiver": 3
    }
  ]
}

In addition to system resource information, it provides:

• Receive log rate for the last 5, 30, and 60 seconds
• Insert log rate for the last 5 and 60 seconds

The script compares the receive and insert rates. A warning is shown when the insert rate is significantly lower than the receive rate:

if receive_60 > 0 and insert_60 < receive_60 * 0.5:
    print(
        "WARNING: Insert lograte is much lower than "
        "receive lograte. Possible insertion backlog."
    )

This can help identify a possible log-processing or database-insertion backlog.

4. Log-Forwarding Status

API URL

/fazsys/monitor/logforward-status

This FortiAnalyzer-only request checks configured log-forwarding destinations.

{
  "id": "5",
  "jsonrpc": "2.0",
  "method": "get",
  "params": [
    {
      "url": "/fazsys/monitor/logforward-status",
      "apiver": 3
    }
  ]
}

The script displays:

• Forwarder ID
• Connection status
• Current forwarding rate
• Connected and disconnected forwarder counts
• Combined forwarding log rate

Example statuses include:

Forwarding logs
Connected, but current forwarding rate is 0
Disconnected - check destination/connectivity

5. Top CPU Processes

API URL

/cli/global/exec/top

This optional API call is enabled with the --processes argument.

{
  "id": "6",
  "method": "exec",
  "params": [
    {
      "url": "/cli/global/exec/top",
      "data": {
        "top-n": 50,
        "order-by": "cpu-usage"
      }
    }
  ]
}

It provides:

• Process ID
• Process name
• CPU utilization
• Memory utilization
• Process state
• Resident and virtual memory
• System load averages

6. Top Disk-I/O Processes

API URL

/cli/global/exec/iotop

{
  "id": "7",
  "method": "exec",
  "params": [
    {
      "url": "/cli/global/exec/iotop",
      "data": {
        "top-n": 50
      }
    }
  ]
}

It provides:

• Process ID and name
• Per-process disk-read rate
• Per-process disk-write rate
• Total system read and write rates
• Actual disk read and write rates

This is useful when investigating high disk-I/O utilization.

Running the Script

Start continuous monitoring:

python perf_monitor.py

Run once and exit:

python perf_monitor.py --once

Include process information:

python perf_monitor.py --processes

Display the top 10 processes:

python perf_monitor.py --processes --top-n 50 --process-limit 10

Override the refresh interval:

python perf_monitor.py --interval 10

Disable terminal colors:

python perf_monitor.py --no-color

Health Thresholds

The script assigns health labels to CPU, memory, and disk utilization:

def health_label(value):
    if value >= 90:
        return "CRITICAL"

    if value >= 80:
        return "WARNING"

    return "GOOD"

Main Features

• Supports both FortiManager and FortiAnalyzer
• Automatically detects the platform
• Displays system information in one terminal dashboard
• Shows individual CPU-core utilization
• Provides detailed disk-performance statistics
• Compares FortiAnalyzer receive and insert log rates
• Highlights disconnected log-forwarding destinations
• Displays top CPU and disk-I/O processes
• Runs API requests concurrently
• Continues displaying available data when one API request fails
• Supports custom CA certificates and SSL verification
• Masks the API key in the terminal output

Sample Output