FortiGate
FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
syao
Staff
Staff
Article Id 368075
Description This article describes why FortiGate is generating the System Event log 'Threat feed overflow'.
Scope FortiOS 7.4.4/7.6.0 and above.
Solution

The log id 22224 refers to 'Threat feed overflow' and will be generated when your threat feed exceeds the allowed limit.

This log message was introduced starting in FortiOS v7.4.4 / v7.6.0.

 

In this example, an IP address threat feed was configured in 40F (one VDOM and running 7.4.6 firmware) which has a 300000 limit. The txt file contains 562032 lines. 

 

FGT40F-1 # diagnose sys external-resource stats IP-ThreatFeed
name: IP-ThreatFeed; uuid_idx: 664; type: address table; update_method: feed; truncated total lines: 300001; valid lines: 300001; error lines: 0; used: no; buildable: 300000; total in count file: 562032; ranges: 0;

 

date=2025-01-03 time=17:20:32 eventtime=1735881631947067619 tz="+1200" logid="0100022224" type="event" subtype="system" level="warning" vd="root" logdesc="Threat feed overflow" msg="Threat feed 'ext-root.IP-ThreatFeed' overflowed. Not all entries in list will be loaded"

Contributors