Technical Tip: 'fnbamd' Daemon Consumes High Memory when Secure STARTTLS is Configured for LDAP

A gradual increase in memory usage by the 'fnbamd' daemon has been observed on FortiGate devices running the above-mentioned versions when STARTTLS is configured in LDAP configuration. This can result in the device entering Memory Conserve Mode.

The problem can be verified by examining the logs as outlined below.

LDAP configuration:

config user ldap
    edit "LDAP-fortiad"
        set server "10.88.0.1"
        set cnid "sAMAccountName"
        set dn "dc=fortiad,dc=info"
        set type regular
        set username "fortiad\\Administrator"
        set password <password>
        set secure starttls
    next
end

diagnose sys top-mem
fnbamd (284): 5745721kB

diagnose sys top 2 100
Run Time: 148 days, 16 hours and 50 minutes
6U, 0N, 3S, 85I, 0WA, 0HI, 6SI, 0ST; 7587T, 2441F
fnbamd 284 S 16.1 25.3 4

This issue has been resolved in v7.2.11 and v7.6.1.

Workaround:
Kill fnbamd process using the commands:

fnsysctl killall fnbamd

Restart the process using a script based on the increasing pattern. This script will restart the process every 6 hours to prevent memory growth over time.

    edit restart_fnbamd
        set interval 21600
        set repeat 0 
        set start auto
        set script 'fnsysctl killall fnbamd'
    next
end

Disable STARTTLS in LDAP configuration using the below commands:

config user ldap
    edit <LDAP_Name>
        set secure disable
end

Logs required by FortiGate TAC for investigation.

1. Logs:
   
   

get system performance status
get system status
diagnose sys top 2 100
diagnose sys top-mem 20
diagnose test application fnbamd 1
diagnose test application fnbamd 2
diagnose test application fnbamd 3
diagnose test application fnbamd 4
diagnose test application fnbamd 6
diagnose sys top-mem 20
diagnose hardware sysinfo memory
diagnose hardware sysinfo slab
diagnose hardware sysinfo shm
diagnose hardware sysinfo conserve
diagnose sys top-mem detail  <----- Note this will only show details of the top 5 processes using the most memory.

Add the number of processes after 'detail' if the process is listed further in the top-mem list.

diagnose sys process pidof fnbamd      <----- Note the process_ID of the fnbamd process here.

fnsysctl cat /proc/[process_ID]/maps  <----- Place the process ID taken from the previous command without the brackets.
diagnose debug crashlog read 

2. TAC Report:
   
   

execute tac report

3. Configuration file of the FortiGate.

Related article:
Technical Tip: How to optimize the Memory consumption