Technical Tip: IPS engine exit reasons

Description

This article describes how to verify the IPS engine exit reasons.

Scope

FortiGate.

Solution

Use the following command:

xenon-kvm95 # diag test app ipsmonitor 3
 
ipsengine exit log:
    pid = 182(cfg), duration = 0 (s) at Thu Oct 29 23:43:02 2020
        code = 11, reason: manual 

Possible IPS Engine Exit Reasons and Their Meanings:

1. manual:

   • Description: The IPS engine was manually stopped by an administrator or due to a configuration setting.
   • Troubleshooting: Check if there were any recent configuration changes or if someone intentionally stopped the engine. Restart the engine if necessary and monitor.

2. cfg int:

   • Description: This indicates communication problems between the IPS engine and its management database.
   • Troubleshooting: Ensure that the management database is online and accessible. Check network connections and configurations.

3. memory cap:

   • Description: The IPS engine memory consumption has surpassed its model-specific predefined value.
   • Troubleshooting: Review the memory allocation for the IPS engine. Consider optimizing configurations or adding more memory resources.

4. seg fault:

   • Description: This points to a crash of the IPS engine due to a segmentation fault.
   • Troubleshooting: Review the engine logs for any indications leading to the crash. It might require a software patch or an update to rectify the issue.