Troubleshooting Tip: FortiOS crashlog shows 'the killed daemon is /bin/dhcpd'

[Matt_B]

Description	This article describes a possible reason for dhcpd daemon messages showing in the crashlog.
Scope	FortiOS with dhcp server enabled.
Solution	The FortiOS dhcpd daemon must restart after any change to dhcp server configuration. A matching entry appears in the crashlog, showing 'the killed daemon is /bin/dhcpd'. This is not a cause for concern if the configuration change was expected. To confirm this, the initial crashlog should be taken. FGT-1 # execute dhcp lease-list port1.108   IP MAC-Address Hostname VCI SSID AP SERVER-ID Expiry   10.255.108.2 00:62:6c:ff:ff:01 Win11-Pro MSFT 5.0 3 Fri Jan 10 17:22:23 2025 FGT-1 # diagnose debug crashlog read | grep dhcpd 2: 2025-01-01 08:41:18 the killed daemon is /bin/dhcpd: status=0x0 4: 2025-01-02 13:46:12 the killed daemon is /bin/dhcpd: status=0x0 FGT-1 # execute date current date is: 2025-01-03 FGT-1 # execute time current time is: 17:24:10 last ntp sync:Fri Jan 3 16:51:29 2025 FGT-1 # diagnose sys process pidof dhcpd 206 Some changes are made to the DHCP server configuration to trigger the DHCP server restart. config system dhcp server     edit 3     set dns-service default     config ip-range         edit 1         set end-ip 10.108.0.250     end end After confirming the change, the dhcpd daemon is restarted automatically and has a new process ID. The device's crashlog has a matching entry. FGT-1 # execute time current time is: 17:25:10 last ntp sync:Fri Jan 3 16:51:29 2025 FGT-1 # diagnose sys process pidof dhcpd 15887 FGT-1 # diagnose debug crashlog read | grep dhcpd 2: 2025-01-01 08:41:18 the killed daemon is /bin/dhcpd: status=0x0 4: 2025-01-02 17:46:12 the killed daemon is /bin/dhcpd: status=0x0 7: 2025-01-03 17:24:34 the killed daemon is /bin/dhcpd: status=0x0 Existing dhcp leases are not affected. FGT-1 # execute dhcp lease-list port1.108   IP MAC-Address Hostname VCI SSID AP SERVER-ID Expiry   10.255.108.2 00:62:6c:ff:ff:01 Win11-Pro MSFT 5.0 3 Fri Jan 10 17:22:23 2025 The changes made are visible under Log & Report -> Events -> System Events -> Add Filter 'Log Description: Object Attribute Configured'. By correlating the system event logs with available crashlog information, an administrator can confirm if a dhcpd restart in the crashlog is the result of a known configuration change.