Troubleshooting Tip: High memory usage when adding external threat feeds with a large number of similar patterns

When a FortiGuard category external threat feed containing a large number of similar patterns (more than 4,000,000 entries, while still within the supported device limits) is configured and applied to a web filter security profile, the WAD daemon may consume high amount of memory resources. This can eventually cause the device to enter memory conserve mode and become unresponsive.

For example

• a1.blogspot.ae
• a2.blogspot.al
• a3.blogspot.am
• a4.blogspot.ba

Etc. 

config system external-resource
    edit "Test01"
        set category 192
        set resource "http://192.168.2.101/65y51s.txt"
    next
end

config webfilter profile
    edit "TestWF_External"
        config ftgd-wf
            unset options
                config filters
                    edit 34
                        set category 192
                        set action block
                    next
                end
            end
        next
    end

diagnose sys top 2 20
wad 613 R 99.9 6.2 1
wad 613 R 99.9 13.2 1
wad 613 R 99.5 20.9 3
wad 613 R 99.9 47.4 18
wad 613 R 99.5 54.4 2
wad 613 R 99.5 61.9 2
wad 613 R 89.0 68.8 2
wad 613 R 99.5 77.2 0

In the output below, the WAD worker type 'algo' is seen consuming more memory.

diagnose test application wad 1000
.
Process [25]: type=algo(3) index=0 pid=613 state=running
diagnosis=no debug=enable valgrind=supported/disabled

Memory usage increases gradually:

get system performance status | grep Memory
Memory: 49451828k total, 30405252k used (61.5%), 18602208k free (37.6%), 444368k freeable (0.9%)
.
get system performance status | grep Memory
Memory: 49451828k total, 34526664k used (69.8%), 14480796k free (29.3%), 444368k freeable (0.9%)
.
get system performance status | grep Memory
Memory: 49451828k total, 38325792k used (77.5%), 10681668k free (21.6%), 444368k freeable (0.9%)

The following errors may be seen on the console of the device:

FWINT2 (profile) # delete T<pid-849 cmdbsvr_cfgsave> [shmf_ptr_from_slabid:346] shmf_filemap_add(fileid=11885, pageid=2) failed: access(/dev/shmfile/11885) failed, error=12(Cannot allocate memory)
<pid-380 /proc/380/cmdline> [lock_reg:150] fcntl(fd=4, cmd=6, lock={type=0,start=4,whence=0,len=1}) failed: 37(No locks available)
<pid-380 /proc/380/cmdline> [lock_reg:150] fcntl(fd=4, cmd=6, lock={type=2,start=4,whence=0,len=1}) failed: 37(No locks available)
<pid-380 /proc/380/cmdline> [lock_reg:150] fcntl(fd=4, cmd=6, lock={type=0,start=4,whence=0,len=1}) failed: 37(No locks available)
<pid-380 /proc/380/cmdline> [lock_reg:150] fcntl(fd=4, cmd=6, lock={type=2,start=4,whence=0,len=1}) failed: 37(No locks available)
<pid-380 /proc/380/cmdline> [lock_reg:150] fcntl(fd=4, cmd=6, lock={type=0,start=4,whence=0,len=1}) failed: 37(No locks available)
can't set buffer size, ret=-1 error:Cannot allocate memory
can't set buffer size, ret=-1 error:Cannot allocate memory
can't set buffer size, ret=-1 error:Cannot allocate memory
can't set buffer size, ret=-1 error:Cannot allocate memory
can't set buffer size, ret=-1 error:Cannot allocate memory
can't set buffer size, ret=-1 error:Cannot allocate memory
sys_set_proc_intval:1800 can not open file /proc/sys/net/core/wmem_max
sys_set_proc_intval:1800 can not open file /proc/sys/net/core/wmem_max
<pid-380 /proc/380/cmdline> [lock_reg:150] fcntl(fd=4, cmd=6, lock={type=0,start=4,whence=0,len=1}) failed: 37(No locks available)
end
can't set buffer size, ret=-1 error:Cannot allocate memory
fork() failed
fork() failed
fork() failed
fork() failed
fork() failed
fork() failed

System event logs for reference:

date="2025-09-12" time="14:39:50" id=7549258814982201269 bid=130331898 dvid=1060 itime=1757698789 euid=3 epid=3 dsteuid=3 dstepid=3 logver=704082795 logid="0100044547" type="event" subtype="system" level="information" action="Add" msg="Add system.external-resource Plotino_Adult" logdesc="Object attribute configured" user="a_920889" ui="ha_daemon" cfgtid=24576231 cfgpath="system.external-resource" cfgobj="Plotino_Adult" cfgattr="uuid[7a00270a-8fff-51f0-acdd-db286eb22a4d]type[domain]category[192]resource[http://X.X.X.X/******]" eventtime=1757698790495591644 tz="-0300" uuid="7a9a23aa-8fff-51f0-38e1-429bc965de69" devid="FG22E1T9********" vd="root" devname="FG22E1"

date="2025-09-12" time="14:45:33" id=7549260288155979483 bid=130332568 dvid=1060 itime=1757699132 euid=3 epid=3 dsteuid=3 dstepid=3 logver=704082795 logid="0100022800" type="event" subtype="system" level="critical" msg="The system has activated session fail mode" logdesc="Scan services session failed" service="wad-http(s)-mapi" mode="activated" eventtime=1757699133322738885 tz="-0300" devid="FG22E1T9********" vd="root" devname="FG22E1"

date="2025-09-12" time="14:45:33" id=7549260292450944039 bid=130332568 dvid=1060 itime=1757699133 euid=3 epid=3 dsteuid=3 dstepid=3 logver=704082795 logid="0100022011" type="event" subtype="system" level="critical" msg="Kernel enters memory conserve mode" logdesc="Memory conserve mode entered" conserve="on" red="42497 MB" green="39599 MB" total=48292 used=42500 service="kernel" eventtime=1757699133323335300 tz="-0300" devid="FG22E1T9********" vd="root" devname="FG22E1"

This issue has been resolved in:

• v7.6.5 (available to download from the Fortinet support portal).
• v8.0.0 (scheduled to be released in March 2026).

These timelines for firmware release are estimated and may be subject to change.

Workaround: Use wildcards to compress similar entries in the threat feed list.