Troubleshooting Tip: Cached memory increases daily due to auto-script output

The device shows a steady daily increase in cached memory. The growth is observed in '/tmp/$$auto-script$$/' and is caused by auto-script commands that generate multiple output files.

Example with memory usage:

fnsysctl df -k
Filesystem 1K-blocks Used Available Use% Mounted on
none 7477436 1802876 5674560 24% /tmp

fnsysctl ls -l /tmp
drwxr-xr-x 2 0 0 Mon Jan x 00:00:00 2026 440 $$auto-script$$

1503856 /tmp/$$auto-script$$
829268 /tmp/$$auto-script$$/autod.0.H50n5E

Observed Behavior:

System time: From X to Y approximately 1-2 days.
/tmp usage: 24% → 34%
Cached memory: 2494768 kB → 3077700 kB

The memory increase is continuous while auto-script commands run. Cached memory is released only after a device reboot.

Root cause:

The auto-script command 'diagnose sniffer packet portx' continuously runs in the background, writing output to temporary files in '/tmp/$$auto-script$$/'. These files are cached in memory and can grow over time.

Auto-script configuration example:

config system auto-script
    edit "autod.20"
        set script "dia sni packet portx"
    next
    edit "autod.22"
        set script "dia sni packet portx"
    next
    edit "autod.4"
        set script "dia sni packet portx"
    next
end

Recommendation:

• Replace long-running commands such as 'diagnose sniffer packet port4' with safer alternatives:

diagnose sniffer packet port4 none 4 100 l

• Consider using external scripts for debugging and automation to prevent cached memory buildup.

Resolution steps:

1. Check files in /tmp/$$auto-script$$/.

fnsysctl ls -al /tmp/$$auto-script$$/

2. Delete auto-script output files.

execute auto-script delete autod.20
execute auto-script delete autod.22
execute auto-script delete autod.4

The 'execute auto-script delete' command only deletes output files in '/tmp', but does not remove the auto-script configuration itself. Therefore, the scripts continue to run and generate new cached files.

3. Verify deletion of output files.

fnsysctl ls -al /tmp/$$auto-script$$/

4. Delete auto-script configuration.

config system auto-script
    delete "autod.20"
    delete "autod.22"
    delete "autod.4"
end

5. Monitor memory usage.

get system performance status

Additional information:

In some cases, 'autod.*' files under '/tmp/$$auto-script$$/' may continue to grow even after auto-script configuration has been removed.

This behavior can occur due to the following sequence:

1. Auto-script commands are running in the background and actively generating output files.
2. The auto-script configuration is removed "before" stopping the running auto-script processes.
3. The background auto-script process remains alive and continues writing output to `/tmp/$$auto-script$$/`.
4. As a result, '/tmp' usage and cached memory continue to increase despite no auto-script configuration being present.

Example:

-rw------- 1 0 0 Wed Jan 28 xx:xx:xx 2026 7606214 autod.0.nGz5Du
-rw------- 1 0 0 Wed Jan 28 xx:xx:xx 2026 7599308 autod.2.xB4gA3
-rw------- 1 0 0 Wed Jan 28 xx:xx:xx 2026 7586360 autod.4.2tD34Y
-rw------- 1 0 0 Wed Jan 28 xx:xx:xx 2026 7582546 autod.6.4XvZoB

Attempting to delete one of the scripts returns:

execute auto-script delete autod.0.nGz5Du
Cannot find script autod.0.nGz5Du
Command fail. Return code -37

To avoid this condition, the recommended sequence is:

1. Stop all running auto-script processes using:

execute auto-script stopall

2. Delete the auto-script output files from '/tmp/$$auto-script$$/'.

3. Remove the auto-script configuration.

    

Note: The 'execute auto-script stopall' command requires at least one auto-script entry to exist under 'config system auto-script'. If all auto-script entries are removed before executing this command, residual processes may remain running.
In such scenarios, a 'device reboot is required' to fully terminate the remaining processes and release cached memory.

Starting with FortiOS version 7.6.1, auto-script output file writing has been optimized, and a caching limitation has been introduced to prevent the files from growing indefinitely.