7.6.0 WAD memory leak, Fortigate 200F

Thank you for sharing your findings. Are you using any policy in proxy mode?

There is a known issue (1042055) related to it, the issue is already fixed and will be included in 7.6.1.

Hello  @bevvet ,

Thank you for contacting the Fortinet Forum portal.

-As mentioned by my colleague there is known issue but for time being if you would like to kill the wad process to optimize the memory configure the below automation stitch which helps to restart the wad process.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-restart-WAD-or-IPS-engine-using-automated/ta-p/190134

Best regards,

Manasa.

If you feel the above steps helped resolve the issue, mark the reply as solved so that other customers can get it easily while searching for similar scenarios.

Hi here,

We have the same problem on the same devices. I have created a ticket for support, but conclusions are strange. Wait conserve mode and run test macros in production devices.

Restart processes doesn't help much. Only kill WAD processes with the most memory usage helps.

We had one policy with proxy mode. I have changed to Flow based, but it doesn't help.

Another strange moment. Support recommended to limit wad processes in config. I set it 8 and after restart WAD processes I have got around 18 processes. It is very strange.

We upgraded v7.2.7 -> 7.4.4.F -> 7.6.0.F . 7.2.7 version was stable. But now memory is rising around 1-2% per day.

Best regards,

Viktor