Technical Tip: Logical serial number feature may cause the Urlfilter process Memory leak

Logical SN is enabled under HA config:

config system ha
...
    set logical-sn enable
...
end

This feature enables two FortiGate serial numbers to be associated with each other on FortiCare to create a single virtual serial number (vSN). It allows FortiGate HA to share a single order of the following subscriptions:

• Enterprise Protection.

• Unified Threat Protection (UTP).

• Advanced Threat Protection (ATP).

When logical-sn is enabled, the urlfilter uses the logical-sn certificate for TLS connections.

It could cause the urlfilter daemon memory leak every time the client certificate was requested.

diagnose sys top-all 1 100 1

0U, 0N, 0S, 100I, 0WA, 0HI, 0SI, 0ST; 3717T, 372F
lnkmtd 236 S 1.9 0.7 2
urlfilter 360 S < 0.0 32.0 0   <-----------------
node 209 S 0.0 7.1 3
ipsengine 401 S < 0.0 3.2 7

This is a known Issue (tracked by Issue ID 1230414 'Improvements to resolve memory usage issues when logical-sn is enabled') and it is resolved in the v7.4.10 release.

The issue will be also fixed in v7.6.6 (which is estimated to be released in March 2026) and v8.0.0 (which is estimated to be released April 2026).

These timelines for firmware release are estimated and may be subject to change.

As the memory leak is generally slow, an automation-stitch executing a script can be scheduled to restart the URL filter at a daily interval can be used as a temporary workaround. An example is provided below. To minimize potential impact, it is recommended to schedule the script outside of working hours. 

config system automation-action

    edit "Restart urlFilter"

        set action-type cli-script

        set script "fnsysctl killall urlfilter"

        set accprofile "super_admin"

    next

end

config system automation-trigger

    edit "UrlFilter"

        set trigger-type scheduled

        set trigger-hour 12

    next

end

config system automation-stitch

    edit "Restart urlFilter"

        set trigger "UrlFilter"

        config actions

            edit 1

                set action "Restart urlFilter"

                set required enable

            next

        end

    next

end