Troubleshooting High-CPU-cost PCRE pattern matching (7.6.1)

In some cases, certain PCRE (Perl Compatible Regular Expression) patterns may result in inefficient matching processes that consume significant CPU resources. This can lead to performance issues such as "CPU stuck" scenarios, where FortiWeb may appear unresponsive, and the your application may temporarily become inaccessible.

To address this, timing thresholds are used to identify high-CPU-cost PCRE matches for further analysis:

• Threshold for inbound traffic (Client-to-FortiWeb): 2 seconds

• Threshold for outbound traffic (FortiWeb-to-Client): 5 seconds

If a PCRE match exceeds the designated threshold, FortiWeb automatically records detailed information about the match. This information can be later dumped or stored in nonvolatile storage for further review and optimization.

Relevant CLI commands for monitoring and managing high CPU usage by PCRE

Starting from 7.6.1, the following commands are added for troubleshooting the high CPU usage caused by PCRE.

• Enable/disable pcre high CPU cost monitoring:

diagnose system waf-signature pcre-high-cpu-cost { enable | disable } //default: enable

• View high CPU cost configuration and summary:

diagnose system waf-signature pcre-high-cpu-cost show { config | briefing }

• Dump recorded high CPU cost pcre data:

diagnose system waf-signature pcre-high-cpu-cost dump

• Clear high CPU cost pcre records:

diagnose system waf-signature pcre-high-cpu-cost cleanup

• Set timing thresholds for high CPU cost pcre matching:

diagnose system waf-signature pcre-high-cpu-cost config threshold { request | response } <threshold> // (1~600) in deci-seconds

• Set extra delay for debugging purposes (available in debug versions only):

diagnose system waf-signature pcre-high-cpu-cost set extra-delay <extra-delay> // (0~6000) in deci-seconds

These commands allow you to monitor and manage high CPU usage caused by inefficient PCRE pattern matching, helping to improve FortiWeb’s performance by identifying and addressing patterns that may require optimization.