FortiGate
FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
tino_p
Staff
Staff
Article Id 324608
Description This article explains the meaning of Node.JS process restart and auto-reboot behavior in FortiGate.
Scope FortiGate.
Solution

In general, a standard process or worker restart does not produce this category of crashes 'Node.JS restarted' and 'Error: kill ESRCH'. If these events appear only once, they are likely caused by the software attempting to terminate or restart a worker/process that was no longer running or could not be located.

 

This crash happens during Node.JS restart. Node.JS triggers a restart for some errors, and during the restart, it tries to terminate all workers, but because of race conditions, it failed to terminate workers (it's already terminated), and that raises this error (because it failed to find a target worker to terminate. ESRCH is Search Error).

 

If the crash occurs infrequently and does not affect the FortiGate’s performance or cause any operational issues, it can generally be considered non-critical unless it leads to a noticeable disruption in production traffic. This approach is particularly useful for FortiGate models, such as the FortiGate-1500D, that do not support the latest firmware versions.

 

If, after manually or automatically shutting down the FortiGate (by script), the FortiGate auto-reboots, it means there is an internal issue:

 

  1. Check the crash log with the following outputs:

 

- "Node.JS restarted" happened several times with "Error: kill ESRCH"

"...2127: 2024-07-01 08:25:59 <00188> Node.JS restarted: (unhandled rejection)
2128: 2024-07-01 08:25:59 <00188> Error: kill ESRCH
2129: 2024-07-01 08:25:59 <00188> at process.kill (node:internal/process/per_thread:232:13)
2130: 2024-07-01 08:25:59 <00188> at /node-scripts/chunk-427c470654a75c6848e3.js:4:484599
2131: 2024-07-01 08:25:59 <00188> at Array.forEach (<anonymous>)
2132: 2024-07-01 08:25:59 <00188> at stopWorkers (/node-scripts/chunk-427c470654a75c6848e3.js:4:484572)
2133: 2024-07-01 08:25:59 <00188> at async CronSchedule.httpsdHealthCheck (/node-scripts/chunk-427c470654
2134: 2024-07-01 08:25:59 a75c6848e3.js:4:477006)
2135: 2024-07-01 08:25:59 <00188> at async Cron._trigger (/node-scripts/chunk-0238041ac4439f9b2c08.js:4:4
2136: 2024-07-01 08:25:59 8619)

..."

 

  1. Check the system events log:

 

"...

date=2024-07-02 time=12:02:13 eventtime=1719896533403457261 tz="+0700" logid="0100032200" type="event" subtype="system" level="critical" vd="root" logdesc="Device shutdown" user="admin" ui="GUI(10.16.36.52)" action="shutdown" msg="User admin shutdown the device from GUI(10.16.36.52)."

date=2024-07-02 time=12:08:06 eventtime=1719896864759070980 tz="+0700" logid="0100032009" type="event" subtype="system" level="information" vd="root" logdesc="FortiGate started" msg="Fortigate started"
...
date=2024-07-01 time=18:30:07 eventtime=1719833408160168579 tz="+0700" logid="0100032200" type="event" subtype="system" level="critical" vd="root" logdesc="Device shutdown" ui="autod" action="shutdown" msg="User shutdown the device from autod. The reason is 'Autod shutdown by stitch: Shutdown Fortigate at 18h30'"

date=2024-07-01 time=18:36:03 eventtime=1719833741559099140 tz="+0700" logid="0100032009" type="event" subtype="system" level="information" vd="root" logdesc="FortiGate started" msg="Fortigate started"

..."

 

It has been resolved in v7.4.5 and v7.6.0.