Troubleshooting Tip : Files dropped by quarantine daemon FortiGate

Determine whether there is a sandbox in the environment, if there is a FortiSandbox. Refer  to this KB article: Technical Tip: How to troubleshoot FortiGate and FortiSandbox communication

execute system fortisandbox test-connectivity

FortiSandbox is not enabled.

Run the debugs:

diagnose debug application quarantine -1

diagnose debug console timestamp enable

diagnose debug enable

2025-06-23 12:49:44 __quar_ipc_recver()-434: New job, cmd 4, req_length 848, qfd: 11
2025-06-23 12:49:44 __quar_job_validation()-156: quarantine: Vfid=0, Status=0, Status-descr=, Service=4, Checksum=f62bcea6, Size=927, URL_length=11, Mail_header_length=0
2025-06-23 12:49:44 __quar_alloc_job_req()-300: New job created, id: 637479
2025-06-23 12:49:44 quar_put_job_req()-331: Job 637479 deleted
2025-06-23 12:49:45 __quar_ipc_recver()-434: New job, cmd 4, req_length 848, qfd: 11
2025-06-23 12:49:45 __quar_job_validation()-156: quarantine: Vfid=0, Status=0, Status-descr=, Service=4, Checksum=ab2432c8, Size=315, URL_length=30, Mail_header_length=0
2025-06-23 12:49:45 __quar_alloc_job_req()-300: New job created, id: 637480
2025-06-23 12:49:45 quar_put_job_req()-331: Job 637480 deleted
2025-06-23 12:49:46 __quar_ipc_recver()-434: New job, cmd 4, req_length 848, qfd: 11
2025-06-23 12:49:46 __quar_job_validation()-156: quarantine: Vfid=0, Status=0, Status-descr=, Service=4, Checksum=3b3487f7, Size=96, URL_length=11, Mail_header_length=0
2025-06-23 12:49:46 __quar_alloc_job_req()-300: New job created, id: 637481
2025-06-23 12:49:46 quar_put_job_req()-331: Job 637481 deleted

In the above logs, see that 'quar': Quarantine daemon is being created and then getting deleted, as there is no FortiSandbox connected.

Check the AV profile and make sure quarantine is not enabled because if it is enabled, the logs will be sent, resulting in the error. This will be visible in the cases where external logging (FortiAnalyzer in this case) is enabled, the behavior observed is firewall generates the traffic to be sent towards the FortiSandbox, but fails as there is none connected, resulting in the issue.

Do:

# unset quarantine

# end

Run the debugs again to verify no 'quar' jobs are getting created:

Configuring sandboxing

Technical Tip: Explaining 'Files dropped by quarantine daemon' log message generated by the FortiGate.