Troubleshooting Tip: IPSengine daemon crashes with signal 11 due to memory corruption

In the output of the 'diagnose debug crashlog read' command, crashes related to ipsengine may be observed.

428: 2025-10-30 02:03:39 <06932> firmware FortiGate-201F v7.6.4,build3596b3596,250820 (GA.F) (Release)
429: 2025-10-30 02:03:39 <06932> application ipsengine 07.006.1154
430: 2025-10-30 02:03:39 <06932> *** signal 11 (Segmentation fault) received ***
431: 2025-10-30 02:03:39 <06932> Register dump:
432: 2025-10-30 02:03:39 <06932> RAX: 00007f229eb87004 RBX: 00007fffcff86e90
433: 2025-10-30 02:03:39 <06932> RCX: 00007f229eb8701b RDX: 00000000ffffffff
434: 2025-10-30 02:03:39 <06932> R08: 0000000000000001 R09: 00007fffcff86ee6
435: 2025-10-30 02:03:39 <06932> R10: 00007f220bd7cb20 R11: 00007f220b437090
436: 2025-10-30 02:03:39 <06932> R12: 00007fffcff86ee6 R13: 0000000000000001
437: 2025-10-30 02:03:39 <06932> R14: 00007f229eb86fff R15: 0000000000000009
438: 2025-10-30 02:03:39 <06932> RSI: 00007f220bd7cb20 RDI: 0000000000000000
439: 2025-10-30 02:03:39 <06932> RBP: 00007fffcff86840 RSP: 00007fffcff86810
440: 2025-10-30 02:03:39 <06932> RIP: 00007f220b436aed EFLAGS: 0000000000010293
441: 2025-10-30 02:03:39 <06932> CS: 0033 FS: 0000 GS: 0000
442: 2025-10-30 02:03:39 <06932> Trap: 000000000000000e Error: 0000000000000004
443: 2025-10-30 02:03:39 <06932> OldMask: 0000000000005a06
444: 2025-10-30 02:03:39 <06932> CR2: 00007f229eb87004
445: 2025-10-30 02:03:39 <06932> stack: 0x7fffcff86810 - 0x7fffcffce980
446: 2025-10-30 02:03:39 <06932> Backtrace:
447: 2025-10-30 02:03:39 <06932> [0x7f220b436aed] => /data/lib/libips.so {0x7f220b1e5000}
448: 2025-10-30 02:03:39 <06932> [0x7f220b4383d5] => /data/lib/libips.so {0x7f220b1e5000}
449: 2025-10-30 02:03:39 <06932> [0x7f220b42c38c] => /data/lib/libips.so {0x7f220b1e5000}
450: 2025-10-30 02:03:39 <06932> [0x7f220b3aeec9] => /data/lib/libips.so {0x7f220b1e5000}
451: 2025-10-30 02:03:39 <06932> [0x7f220b3af896] => /data/lib/libips.so {0x7f220b1e5000}
452: 2025-10-30 02:03:39 <06932> [0x7f220b3b0c50] => /data/lib/libips.so {0x7f220b1e5000}
453: 2025-10-30 02:03:39 <06932> [0x7f220b3b13a6] => /data/lib/libips.so {0x7f220b1e5000}
454: 2025-10-30 02:03:39 <06932> [0x7f220b3b816c] => /data/lib/libips.so {0x7f220b1e5000}
455: 2025-10-30 02:03:39 <06932> [0x7f220b3b4835] => /data/lib/libips.so {0x7f220b1e5000}
456: 2025-10-30 02:03:39 <06932> [0x7f220b9ef82e] => /data/lib/libips.so {0x7f220b1e5000}
457: 2025-10-30 02:03:39 <06932> [0x7f220b4a5cf8] => /data/lib/libips.so {0x7f220b1e5000}
458: 2025-10-30 02:03:39 <06932> [0x7f220b3b1666] => /data/lib/libips.so {0x7f220b1e5000}
459: 2025-10-30 02:03:39 <06932> [0x7f220b3b3c5f] => /data/lib/libips.so {0x7f220b1e5000}
460: 2025-10-30 02:03:39 <06932> [0x7f220b3c25b8] => /data/lib/libips.so {0x7f220b1e5000}
461: 2025-10-30 02:03:39 <06932> [0x7f220b2e9653] => /data/lib/libips.so {0x7f220b1e5000}
462: 2025-10-30 02:03:39 <06932> [0x7f221972a004] => /bin/ipsengine {0x7f2218504000}
463: 2025-10-30 02:03:39 <06932> [0x7f221971e571] => /bin/ipsengine {0x7f2218504000}
464: 2025-10-30 02:03:39 <06932> [0x7f22196fd8a9] => /bin/ipsengine {0x7f2218504000}
465: 2025-10-30 02:03:39 <06932> [0x7f220b5f97ee] => /data/lib/libips.so {0x7f220b1e5000}
466: 2025-10-30 02:03:39 <06932> [0x7f220b5e8eef] => /data/lib/libips.so {0x7f220b1e5000}
467: 2025-10-30 02:03:39 <06932> [0x7f221972449c] => /bin/ipsengine {0x7f2218504000}
468: 2025-10-30 02:03:39 <06932> [0x7f2218861af3] => /bin/ipsengine {0x7f2218504000}
469: 2025-10-30 02:03:39 <06932> [0x7f2211861e1b] => /lib/libc.so.6 {0x7f221183e000}
470: 2025-10-30 02:03:39 <06932> [0x7f221886100a] => /bin/ipsengine {0x7f2218504000}
471: 2025-10-30 02:03:39 <06932> fortidev 6.0.2.0008
472: 2025-10-30 02:03:39 [IPS Engine <06932>] base: 0x7f220b1e5000
473: 2025-10-30 02:03:39 [IPS Engine <06932>] Dissector statistics:
474: 2025-10-30 02:03:39 HTTP2 Dissector Statistics:
Sessions | opened 1553300 confirmed 8 closed
475: 2025-10-30 02:03:39 1539274
Streams | opened 0 closed 0 closing 0 active 0 longest expiry 0
476: 2025-10-30 02:03:39 [IPS Engine <06932>] Last session info:
477: 2025-10-30 02:03:39 [IPS Engine <06932>] Session ID:1749558 Serial:252268854 Proto:6 Age:0
478: 2025-10-30 02:03:39 Idle:0 Flag:0x26 Feature:0x2 Ignore:0,0 Encap:0
479: 2025-10-30 02:03:39 [IPS Engine <06932>] Client: 10.65.25.83:42104 Server: 172.17.73.11:80
480: 2025-10-30 02:03:39 [IPS Engine <06932>] Stream: C-2800/2/2800, S-0/0/0
481: 2025-10-30 02:03:39 [IPS Engine <06932>] Service: http

This issue has been resolved in IPSE versions 7.4:0589, 7.6:1158, 8.x:0004

Note: Contact Fortinet support if the FortiGate is running on an older IPSE versions. The 'diagnose autoupdate versions' command can be used to verify the IPS Attack Engine version.