Skip to main content
ssanga
Staff & Editor
ssanga
Staff & Editor
March 6, 2026

Troubleshooting Tip: Frequent ipsengine daemon crashes (Signal 11) causing Intrusion Prevention Scanning Failures

  • March 6, 2026
  • 0 replies
  • 1691 views
Description This article describes an issue where the ipsengine daemon repeatedly crashes with Signal 11, resulting in intrusion prevention scanning failures.
Due to these crashes, certain websites or traffic sessions may be blocked by the FortiGate because the Intrusion Prevention System (IPS) is unable to properly inspect the traffic, leading to IPS scanning failure events.
Scope FortiGate v7.4.10, v7.4.11.
Solution

Frequent ipsengine crashes may be seen in the command output 'diagnose debug crashlog read'.

 

9913: 2026-02-02 10:26:42 <11933> firmware FortiGate-4400F v7.4.11,build2878b2878,260126 (GA.M) (Release)
9914: 2026-02-02 10:26:42 <11933> application ipsengine 07.004.596
9915: 2026-02-02 10:26:42 <11933> *** signal 11 (Segmentation fault) received ***
9916: 2026-02-02 10:26:42 <11933> Register dump:
9917: 2026-02-02 10:26:42 <11933> RAX: 00000000ffffffa5 RBX: 00007f5c2fec0000
9918: 2026-02-02 10:26:42 <11933> RCX: 00007f5d2fecf430 RDX: 00007f5d2fecf3b0
9919: 2026-02-02 10:26:42 <11933> R08: 00007ffdad90e6e6 R09: 0000000000000001
9920: 2026-02-02 10:26:42 <11933> R10: 00007f5cdcf3a780 R11: 0000000000000001
9921: 2026-02-02 10:26:42 <11933> R12: 00007f5cba50de40 R13: 00007f5c2b2782c0
9922: 2026-02-02 10:26:42 <11933> R14: 00007ffdad910ad0 R15: 00007ffdad90e4c0
9923: 2026-02-02 10:26:42 <11933> RSI: 00007ffdad90e6c8 RDI: 00007f5c2fec0000
9924: 2026-02-02 10:26:42 <11933> RBP: 00007ffdad90e1a0 RSP: 00007ffdad90e078
9925: 2026-02-02 10:26:42 <11933> RIP: 00007f5cdc72d219 EFLAGS: 0000000000010283
9926: 2026-02-02 10:26:42 <11933> CS: 0033 FS: 0000 GS: 0000
9927: 2026-02-02 10:26:42 <11933> Trap: 000000000000000e Error: 0000000000000004
9928: 2026-02-02 10:26:42 <11933> OldMask: 0000000000005a06
9929: 2026-02-02 10:26:42 <11933> CR2: 00007f5d2fecf3b0
9930: 2026-02-02 10:26:42 <11933> stack: 0x7ffdad90e078 - 0x7ffdad96fa00
9931: 2026-02-02 10:26:42 <11933> Backtrace:
9932: 2026-02-02 10:26:42 <11933> [0x7f5cdc72d219] => /data/lib/libips.so {0x7f5cdc4dc000}
9933: 2026-02-02 10:26:42 <11933> [0x7f5cdc73843a] => /data/lib/libips.so {0x7f5cdc4dc000}
9934: 2026-02-02 10:26:42 <11933> [0x7f5cdc68fc37] => /data/lib/libips.so {0x7f5cdc4dc000}
9935: 2026-02-02 10:26:42 <11933> [0x7f5cdc6906b6] => /data/lib/libips.so {0x7f5cdc4dc000}
9936: 2026-02-02 10:26:42 <11933> [0x7f5cdc6919d3] => /data/lib/libips.so {0x7f5cdc4dc000}
9937: 2026-02-02 10:26:42 <11933> [0x7f5cdc692196] => /data/lib/libips.so {0x7f5cdc4dc000}
9938: 2026-02-02 10:26:42 <11933> [0x7f5cdc69ce60] => /data/lib/libips.so {0x7f5cdc4dc000}
9939: 2026-02-02 10:26:42 <11933> [0x7f5cdc69d2a3] => /data/lib/libips.so {0x7f5cdc4dc000}
9940: 2026-02-02 10:26:42 <11933> [0x7f5cdc69b736] => /data/lib/libips.so {0x7f5cdc4dc000}
9941: 2026-02-02 10:26:42 <11933> [0x7f5cdc69bc3c] => /data/lib/libips.so {0x7f5cdc4dc000}
9942: 2026-02-02 10:26:42 <11933> [0x7f5cdc697205] => /data/lib/libips.so {0x7f5cdc4dc000}
9943: 2026-02-02 10:26:42 <11933> [0x7f5cdc698af0] => /data/lib/libips.so {0x7f5cdc4dc000}
9944: 2026-02-02 10:26:42 <11933> [0x7f5cdc79983f] => /data/lib/libips.so {0x7f5cdc4dc000}
9945: 2026-02-02 10:26:42 <11933> [0x7f5cdccd8abe] => /data/lib/libips.so {0x7f5cdc4dc000}
9946: 2026-02-02 10:26:42 <11933> [0x7f5cdcce35ea] => /data/lib/libips.so {0x7f5cdc4dc000}
9947: 2026-02-02 10:26:42 <11933> [0x7f5cdc7a1366] => /data/lib/libips.so {0x7f5cdc4dc000}
9948: 2026-02-02 10:26:42 <11933> [0x7f5cdc69413d] => /data/lib/libips.so {0x7f5cdc4dc000}
9949: 2026-02-02 10:26:42 <11933> [0x7f5cdc696513] => /data/lib/libips.so {0x7f5cdc4dc000}
9950: 2026-02-02 10:26:42 <11933> [0x7f5cdc6a5050] => /data/lib/libips.so {0x7f5cdc4dc000}
9951: 2026-02-02 10:26:42 <11933> [0x7f5cdc5c2bb3] => /data/lib/libips.so {0x7f5cdc4dc000}
9952: 2026-02-02 10:26:42 <11933> [0x557be6a18ade] => /bin/ipsengine {0x557be57ce000}
9953: 2026-02-02 10:26:42 <11933> [0x557be6a19337] => /bin/ipsengine {0x557be57ce000}
9954: 2026-02-02 10:26:42 <11933> [0x557be6a1978b] => /bin/ipsengine {0x557be57ce000}
9955: 2026-02-02 10:26:42 <11933> [0x557be6a17421] => /bin/ipsengine {0x557be57ce000}
9956: 2026-02-02 10:26:42 <11933> [0x557be69f7c29] => /bin/ipsengine {0x557be57ce000}
9957: 2026-02-02 10:26:42 <11933> [0x7f5cdc8ecf00] => /data/lib/libips.so {0x7f5cdc4dc000}
9958: 2026-02-02 10:26:42 <11933> [0x7f5cdc8ed70f] => /data/lib/libips.so {0x7f5cdc4dc000}
9959: 2026-02-02 10:26:42 <11933> [0x557be6a1d085] => /bin/ipsengine {0x557be57ce000}
9960: 2026-02-02 10:26:42 <11933> [0x557be5aec17e] => /bin/ipsengine {0x557be57ce000}
9961: 2026-02-02 10:26:42 <11933> [0x557be6a1dc22] => /bin/ipsengine {0x557be57ce000}
9962: 2026-02-02 10:26:42 <11933> [0x557be6a1f5a7] => /bin/ipsengine {0x557be57ce000}
9963: 2026-02-02 10:26:42 <11933> [0x557be6a1f02d] => /bin/ipsengine {0x557be57ce000}
9964: 2026-02-02 10:26:42 <11933> [0x557be5aebfa3] => /bin/ipsengine {0x557be57ce000}
9965: 2026-02-02 10:26:42 <11933> [0x7f5ce3a9be1b] => /lib/libc.so.6 {0x7f5ce3a78000}
9966: 2026-02-02 10:26:42 <11933> [0x557be5ae716a] => /bin/ipsengine {0x557be57ce000}
9967: 2026-02-02 10:26:42 <11933> fortidev 6.0.2.0008
9968: 2026-02-02 10:26:42 [IPS Engine <11933>] base: 0x7f5cdc4dc000
9969: 2026-02-02 10:26:42 [IPS Engine <11933>] Dissector statistics:
9970: 2026-02-02 10:26:42 HTTP2 Dissector Statistics:
Sessions | opened 489096 confirmed 3 closed
9971: 2026-02-02 10:26:42 466359
Streams | opened 19 closed 19 closing 0 active 0 longest expiry 0
9972: 2026-02-02 10:26:42 [IPS Engine <11933>] Last session info:
9973: 2026-02-02 10:26:42 [IPS Engine <11933>] Session ID:692840 Serial:0 Proto:6 Age:0 Idle:0
9974: 2026-02-02 10:26:42 Flag:0x62 Feature:0x6 Ignore:0,0 Encap:0
9975: 2026-02-02 10:26:42 [IPS Engine <11933>] Client: 10.3.177.118:55616 Server: 199.232.75.10:443
9976: 2026-02-02 10:26:42 [IPS Engine <11933>] Stream: C-16108/1/16108, S-0/0/0
9977: 2026-02-02 10:26:42 [IPS Engine <11933>] Service: http
9978: 2026-02-02 10:26:42 [IPS Engine <11933>] URL: www.shrm.org/content/shrm/saml_login
9979: 2026-02-02 10:26:56 ipsengine 07.004.596 previously crashed 2 times. The last crash was at
9980: 2026-02-02 10:26:56 2026-02-02 10:26:42.

The decoded crashlog is as follows:


9913: 2026-02-02 10:26:42 <11933> firmware FortiGate-4400F v7.4.11,build2878b2878,260126 (GA.M) (Release)
9914: 2026-02-02 10:26:42 <11933> application ipsengine 07.004.596
9915: 2026-02-02 10:26:42 <11933> *** signal 11 (Segmentation fault) received ***
9916: 2026-02-02 10:26:42 <11933> Register dump:
9917: 2026-02-02 10:26:42 <11933> RAX: 00000000ffffffa5 RBX: 00007f5c2fec0000
9918: 2026-02-02 10:26:42 <11933> RCX: 00007f5d2fecf430 RDX: 00007f5d2fecf3b0
9919: 2026-02-02 10:26:42 <11933> R08: 00007ffdad90e6e6 R09: 0000000000000001
9920: 2026-02-02 10:26:42 <11933> R10: 00007f5cdcf3a780 R11: 0000000000000001
9921: 2026-02-02 10:26:42 <11933> R12: 00007f5cba50de40 R13: 00007f5c2b2782c0
9922: 2026-02-02 10:26:42 <11933> R14: 00007ffdad910ad0 R15: 00007ffdad90e4c0
9923: 2026-02-02 10:26:42 <11933> RSI: 00007ffdad90e6c8 RDI: 00007f5c2fec0000
9924: 2026-02-02 10:26:42 <11933> RBP: 00007ffdad90e1a0 RSP: 00007ffdad90e078
9925: 2026-02-02 10:26:42 <11933> RIP: 00007f5cdc72d219 EFLAGS: 0000000000010283
9926: 2026-02-02 10:26:42 <11933> CS: 0033 FS: 0000 GS: 0000
9927: 2026-02-02 10:26:42 <11933> Trap: 000000000000000e Error: 0000000000000004
9928: 2026-02-02 10:26:42 <11933> OldMask: 0000000000005a06
9929: 2026-02-02 10:26:42 <11933> CR2: 00007f5d2fecf3b0
9930: 2026-02-02 10:26:42 <11933> stack: 0x7ffdad90e078 - 0x7ffdad96fa00
9931: 2026-02-02 10:26:42 <11933> Backtrace:
9932: 2026-02-02 10:26:42 <11933> [0x7f5cdc72d219] => /data/libips.so => liboffset 0x251219: get_user_agent_by_session at /home/devops/ips-build-env/code/ipsbuild-28auIR/../so/dissectors/ips_http.c:973 (discriminator 1)
9933: 2026-02-02 10:26:42 <11933> [0x7f5cdc73843a] => /data/libips.so => liboffset 0x25c43a: ips_dsct_http_control at /home/devops/ips-build-env/code/ipsbuild-28auIR/../so/dissectors/ips_http.c:1455
9934: 2026-02-02 10:26:42 <11933> [0x7f5cdc68fc37] => /data/libips.so => liboffset 0x1b3c37: ips_log_get_http_user_agent at /home/devops/ips-build-env/code/ipsbuild-28auIR/../so/ips_log.c:881
9935: 2026-02-02 10:26:42 <11933> [0x7f5cdc6906b6] => /data/libips.so => liboffset 0x1b46b6: ips_log at /home/devops/ips-build-env/code/ipsbuild-28auIR/../so/ips_log.c:1080
9936: 2026-02-02 10:26:42 <11933> [0x7f5cdc6919d3] => /data/libips.so => liboffset 0x1b59d3: ips_report_alert_va_internal at /home/devops/ips-build-env/code/ipsbuild-28auIR/../so/ips_log.c:2448
9937: 2026-02-02 10:26:42 <11933> [0x7f5cdc692196] => /data/libips.so => liboffset 0x1b6196: ips_report_alert at /home/devops/ips-build-env/code/ipsbuild-28auIR/../so/ips_log.c:2228
9938: 2026-02-02 10:26:42 <11933> [0x7f5cdc69ce60] => /data/libips.so => liboffset 0x1c0e60: appctrl_process_match at /home/devops/ips-build-env/code/ipsbuild-28auIR/../so/ips_match.c:1813
9939: 2026-02-02 10:26:42 <11933> [0x7f5cdc69d2a3] => /data/libips.so => liboffset 0x1c12a3: match_app_callback at /home/devops/ips-build-env/code/ipsbuild-28auIR/../so/ips_match.c:1858
9940: 2026-02-02 10:26:42 <11933> [0x7f5cdc69b736] => /data/libips.so => liboffset 0x1bf736: ips_match_candidates at /home/devops/ips-build-env/code/ipsbuild-28auIR/../so/ips_match.c:1281
9941: 2026-02-02 10:26:42 <11933> [0x7f5cdc69bc3c] => /data/libips.so => liboffset 0x1bfc3c: match_app at /home/devops/ips-build-env/code/ipsbuild-28auIR/../so/ips_match.c:1879
9942: 2026-02-02 10:26:42 <11933> [0x7f5cdc697205] => /data/libips.so => liboffset 0x1bb205: ips_match_all_candidates at /home/devops/ips-build-env/code/ipsbuild-28auIR/../so/ips_match.c:2557 (discriminator 2)
9943: 2026-02-02 10:26:42 <11933> [0x7f5cdc698af0] => /data/libips.so => liboffset 0x1bcaf0: ips_add_candidate_rule at /home/devops/ips-build-env/code/ipsbuild-28auIR/../so/ips_match.c:166 (discriminator 11)
9944: 2026-02-02 10:26:42 <11933> [0x7f5cdc79983f] => /data/libips.so => liboffset 0x2bd83f: ipsa_add_candidate at /home/devops/ips-build-env/code/ipsbuild-28auIR/../so/ipsa/ipsa_adapter.h:76
9945: 2026-02-02 10:26:42 <11933> [0x7f5cdccd8abe] => /data/libips.so => liboffset 0x7fcabe: ipsa_nc_prematch_search at /home/devops/ips-build-env/code/ipsbuild-28auIR/../so/ipsa/ipsa_nc_prematch.c:1788
9946: 2026-02-02 10:26:42 <11933> [0x7f5cdcce35ea] => /data/libips.so => liboffset 0x8075ea: ips_detect_sync at /home/devops/ips-build-env/code/ipsbuild-28auIR/../so/ips_search.c:1185
9947: 2026-02-02 10:26:42 <11933> [0x7f5cdc7a1366] => /data/libips.so => liboffset 0x2c5366: ips_opt_decode_base64_control_handler at /home/devops/ips-build-env/code/ipsbuild-28auIR/../so/options/ips_opt_decoder_control.c:233
9948: 2026-02-02 10:26:42 <11933> [0x7f5cdc69413d] => /data/libips.so => liboffset 0x1b813d: ips_match_rule at /home/devops/ips-build-env/code/ipsbuild-28auIR/../so/ips_match.c:627
9949: 2026-02-02 10:26:42 <11933> [0x7f5cdc696513] => /data/libips.so => liboffset 0x1ba513: ips_match_rule_and_update_perf at /home/devops/ips-build-env/code/ipsbuild-28auIR/../so/ips_match.c:690
9950: 2026-02-02 10:26:42 <11933> [0x7f5cdc6a5050] => /data/libips.so => liboffset 0x1c9050: ips_process_event at /home/devops/ips-build-env/code/ipsbuild-28auIR/../so/ips_process.c:2802
9951: 2026-02-02 10:26:42 <11933> [0x7f5cdc5c2bb3] => /data/libips.so => liboffset 0xe6bb3: ips_so_process_packet at /home/devops/ips-build-env/code/ipsbuild-28auIR/../so/ips_so_stubs.c:867
9952: 2026-02-02 10:26:42 <11933> [0x557be6a18ade] => /bin/ipsengine {0x557be57ce000} => ips_l7_session_packet at ././ips/ips_main.c:3741 (discriminator 3)
9953: 2026-02-02 10:26:42 <11933> [0x557be6a19337] => /bin/ipsengine {0x557be57ce000} => ips_l7_on_data_msg at ././ips/ips_main.c:4008
9954: 2026-02-02 10:26:42 <11933> [0x557be6a1978b] => /bin/ipsengine {0x557be57ce000} => ips_l7_on_data_event at ././ips/ips_main.c:4108
9955: 2026-02-02 10:26:42 <11933> [0x557be6a17421] => /bin/ipsengine {0x557be57ce000} => ips_fed_event_handler at ././ips/ips_main.c:3222
9956: 2026-02-02 10:26:42 <11933> [0x557be69f7c29] => /bin/ipsengine {0x557be57ce000} => ipsuv_event_handler at ././ips/ips_libuv.c:423
9957: 2026-02-02 10:26:42 <11933> [0x7f5cdc8ecf00] => /data/libips.so => liboffset 0x410f00: uv__io_poll at /home/devops/ips-build-env/code/ipsbuild-28auIR/../share/src/libuv/src/unix/linux.c:1531
9958: 2026-02-02 10:26:42 <11933> [0x7f5cdc8ed70f] => /data/libips.so => liboffset 0x41170f: uv_run at /home/devops/ips-build-env/code/ipsbuild-28auIR/../share/src/libuv/src/unix/core.c:452
9959: 2026-02-02 10:26:42 <11933> [0x557be6a1d085] => /bin/ipsengine {0x557be57ce000} => start_ips_sensor_process at ././ips/ips_main.c:5808
9960: 2026-02-02 10:26:42 <11933> [0x557be5aec17e] => /bin/ipsengine {0x557be57ce000} => fortiexecve at ././sysinit/fortiexec.c:886
9961: 2026-02-02 10:26:42 <11933> [0x557be6a1dc22] => /bin/ipsengine {0x557be57ce000} => fork_child at ././ips/ips_monitor.c:210
9962: 2026-02-02 10:26:42 <11933> [0x557be6a1f5a7] => /bin/ipsengine {0x557be57ce000} => start_child at ././ips/ips_monitor.c:223
9963: 2026-02-02 10:26:42 <11933> [0x557be6a1f02d] => /bin/ipsengine {0x557be57ce000} => ipsmonitor_main at ././ips/ips_monitor.c:866
9964: 2026-02-02 10:26:42 <11933> [0x557be5aebfa3] => /bin/ipsengine {0x557be57ce000} => fortiexec_call_main at ././sysinit/fortiexec.c:806
9965: 2026-02-02 10:26:42 <11933> [0x7f5ce3a9be1b] => /lib/libc.so.6 {0x7f5ce3a78000} => ?? ??:0
9966: 2026-02-02 10:26:42 <11933> [0x557be5ae716a] => /bin/ipsengine {0x557be57ce000} => _start at /build/glibc/glibc-2.30/csu/../sysdeps/x86_64/start.S:122
9967: 2026-02-02 10:26:42 <11933> fortidev 6.0.2.0008
9968: 2026-02-02 10:26:42 [IPS Engine <11933>] base: 0x7f5cdc4dc000
9969: 2026-02-02 10:26:42 [IPS Engine <11933>] Dissector statistics:
9970: 2026-02-02 10:26:42 HTTP2 Dissector Statistics:
Sessions | opened 489096 confirmed 3 closed
9971: 2026-02-02 10:26:42 466359
Streams | opened 19 closed 19 closing 0 active 0 longest expiry 0
9972: 2026-02-02 10:26:42 [IPS Engine <11933>] Last session info:
9973: 2026-02-02 10:26:42 [IPS Engine <11933>] Session ID:692840 Serial:0 Proto:6 Age:0 Idle:0
9974: 2026-02-02 10:26:42 Flag:0x62 Feature:0x6 Ignore:0,0 Encap:0
9975: 2026-02-02 10:26:42 [IPS Engine <11933>] Client: 10.3.177.118:55616 Server: 199.232.75.10:443
9976: 2026-02-02 10:26:42 [IPS Engine <11933>] Stream: C-16108/1/16108, S-0/0/0
9977: 2026-02-02 10:26:42 [IPS Engine <11933>] Service: http
9978: 2026-02-02 10:26:42 [IPS Engine <11933>] URL: www.shrm.org/content/shrm/saml_login
9979: 2026-02-02 10:26:56 ipsengine 07.004.596 previously crashed 2 times. The last crash was at
9980: 2026-02-02 10:26:56 2026-02-02 10:26:42

 

This issue occurs due to improper HTTP header offset tracking leading to potential buffer overflow/underflow when buffers are modified in place.

This issue has been resolved in IPSE versions 7.4:0600, 7.6:1177, 8.0:0021.
    Terms & ConditionsAccessibility statement
    Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
    Fortinet Flag the Hack. Wednesday, August 26, 9:00 AM - 5:00 PM ET, COSM, Atlanta, GA.
    Virtual event | September 2026. SASE summit. The age of autonomous trust. Register here!