Skip to main content
Thizozo
New Member
January 29, 2026
Question

Memory Saturation FGT 1100E

  • January 29, 2026
  • 4 replies
  • 463 views

Hi Team

 

We have a FGT 1100E That had an issue of a process draining the RAM, it went into Conserve mode after trying to process an extremely large volume of traffic which effectively exhausted resources.

Is there separation on the Control and Data plane on this platform(FGT 1100E) for the memory usage as I understand things:

 

Session setup and teardown(State) is managed from the control plane that this process is a part of hence would be contributing to the problem where we see these large influx of traffic requiring session setup, but other products are not affected as packet forwarding is processed within the Data plane .

 

 

4 replies

Toshi_Esumi
SuperUser
SuperUser
January 29, 2026

Whatever the cause of memory leak is/was, I would immediately open a ticket at TAC to get it examined. But run line "diag sys top 5 40" then Shift-m to see what processes are eating up the memory, which would give you a good idea if it's caused by a bug in your version, or simply too many processes in the same type are running at the same time. 
Also check if any significant crashes in "diag debug crashlog read" when the conserve mode happened.

Toshi

Thizozo
ThizozoAuthor
New Member
January 29, 2026

It was noted that "cmdbsvr" is the process that is causing the issue.

on the FGT 1100E Is there separation on the Control and Data plane?

adambomb1219
SuperUser
SuperUser
January 29, 2026

What version? Is the firewall undersized?

Thizozo
ThizozoAuthor
New Member
January 29, 2026

Currently its on v7.4.7

adambomb1219
SuperUser
SuperUser
January 29, 2026

How much traffic was this? Is the firewall undersized? What inspection profiles?

Thizozo
ThizozoAuthor
New Member
January 29, 2026

Hi 

 

From the logs we note the following when the incident happened:

Memory: 16432140k total, 13148072k used (80.0%), 2805988k free (17.1%), 478080k freeable (2.9%)
Average network usage: 12712 / 77 kbps in 1 minute, 84680 / 78 kbps in 10 minutes, 70710 / 338 kbps in 30 minutes
Maximal network usage: 19746 / 115 kbps in 1 minute, 225616 / 115 kbps in 10 minutes, 225616 / 38829 kbps in 30 minutes
Average sessions: 161579 sessions in 1 minute, 162137 sessions in 10 minutes, 160841 sessions in 30 minutes
Maximal sessions: 168206 sessions in 1 minute, 171304 sessions in 10 minutes, 171304 sessions in 30 minutes

 

1U, 0N, 0S, 99I, 0WA, 0HI, 0SI, 0ST; 16047T, 2575F
bcm.user 165 S < 16.9 0.6 4
fltund 303 S 0.4 0.0 10
cmdbsvr 208 S 0.0 39.4 0

 

As for the FGT being undersized i am also wondering if it might be the case.

HarryTran
Staff
Staff
January 29, 2026

Could you try below commands (several times per each), then attach the output files for our references.
diagnose sys top-mem 20

diagnose sys top-all 2 20

get system performance status

If possible, when the box is under high memory condition, try to run this script and share the result to me via chat box, I will have a look.
https://community.fortinet.com/t5/FortiGate/Technical-Tip-TAC-debug-script-with-TeraTerm/ta-p/287059

 

Thizozo
ThizozoAuthor
New Member
January 30, 2026

Hi Harry 

i will run the  diagnose and share the outputs,