Technical Tip: Explanation of memory_tension_drop counter

Description

This article describes the memory_tension_drop counter and explains how it indicates packet drops caused by memory resource constraints within the FortiGate packet-processing path.

Scope

FortiGate.

Solution

The memory_tension_drop tells how many sessions have been dropped because the system ran out of usable memory since the last reboot.

Use the command below to review the counter:

# diagnose sys session stat
misc info:     session_count=252 setup_rate=7 exp_count=1 clash=173
memory_tension_drop=13035 ephemeral=0/61440 removeable=0
delete=0, flush=0, dev_down=0/0

TCP sessions:
     1 in NONE state
     83 in ESTABLISHED state
     7 in SYN_SENT state
     6 in FIN_WAIT state
     8 in TIME_WAIT state
     1 in CLOSE state
     2 in CLOSE_WAIT state
firewall error stat:
error1=00000000
error2=00000000
error3=00000000
error4=00000000
tt=00000000
cont=00000000
ids_recv=00000000
url_recv=00000000
av_recv=003516f6
fqdn_count=00000070

tcp reset stat:
syncqf=386 acceptqf=0 no-listener=90836 data=0 ses=581 ips=0
global: ses_limit=0 ses6_limit=0 rt_limit=0 rt6_limit=0

The memory tension drop is a mechanism for deleting kernel sessions due to a lack of memory, but it has no direct relationship to conserve mode.

When the kernel cannot allocate memory (no free memory available), the session table is scanned, and the oldest sessions are deleted.

The counter memory_tension_drop records the number of sessions deleted by this process. It is a cumulative counter.

This counter should remain at 0; it means the unit is running too high in memory.