Looking for information on "diagnose Sys session full-stat" command
Hello,
We have a pretty important FG-500E that is serving several thousand users and recently it has started randomly dropping sessions. It seems to be most noticeable when users are downloading files as the download suddenly halts and because the session has been dropped, the download never recovers. It happens seemingly randomly although we have been seeing a few of session clashes in the logs.
I have been trying to get to the bottom of it and when I run the "diagnose sys session full-stat" command I get an output similar to the following:
session table: table_size=4194304 max_depth=3 used=63751 misc info: session_count=29993 setup_rate=147 exp_count=1 clash=1276 memory_tension_drop=0 ephemeral=0/1113088 removeable=0 npu_session_count=15907 nturbo_session_count=2676 delete=0, flush=0, dev_down=2/229 ses_flush_filters=0 flush_work_num=0 TCP sessions: 1 in NONE state 26293 in ESTABLISHED state 43 in SYN_SENT state 6 in SYN_RECV state 9 in FIN_WAIT state 98 in TIME_WAIT state 421 in CLOSE state 715 in CLOSE_WAIT state firewall error stat: error1=00000000 error2=003be7ea error3=00000000 error4=00000000 tt=00000000 cont=01bbff8f ids_recv=c3b506e3 url_recv=00000000 av_recv=15dcfe56 fqdn_count=0000000a fqdn6_count=00000000
When I contrast the output with any other firewalls we run (we have over 20) the error2=xxxxxx column contains error2=00000000 and there are no clashes.
Does anyone have any idea what the error counters actually represent? I have found an old article that claims error1 is to do with a mismatch of encryption state but I cannot find any information on any of the other errors.
Does anyone here have any ideas?