Troubleshooting Tip: IPSengine daemon crashes with signal 11 due to memory corruption

[ssanga]

Description	This article addresses an issue where the ipsengine daemon crashes with Signal 11 as a result of memory corruption.
Scope	FortiGate v7.4.7, v7.6.4.
Solution	In the output of the 'diagnose debug crashlog read' command, crashes related to ipsengine may be observed. 428: 2025-10-30 02:03:39 <06932> firmware FortiGate-201F v7.6.4,build3596b3596,250820 (GA.F) (Release) 429: 2025-10-30 02:03:39 <06932> application ipsengine 07.006.1154 430: 2025-10-30 02:03:39 <06932> *** signal 11 (Segmentation fault) received *** 431: 2025-10-30 02:03:39 <06932> Register dump: 432: 2025-10-30 02:03:39 <06932> RAX: 00007f229eb87004 RBX: 00007fffcff86e90 433: 2025-10-30 02:03:39 <06932> RCX: 00007f229eb8701b RDX: 00000000ffffffff 434: 2025-10-30 02:03:39 <06932> R08: 0000000000000001 R09: 00007fffcff86ee6 435: 2025-10-30 02:03:39 <06932> R10: 00007f220bd7cb20 R11: 00007f220b437090 436: 2025-10-30 02:03:39 <06932> R12: 00007fffcff86ee6 R13: 0000000000000001 437: 2025-10-30 02:03:39 <06932> R14: 00007f229eb86fff R15: 0000000000000009 438: 2025-10-30 02:03:39 <06932> RSI: 00007f220bd7cb20 RDI: 0000000000000000 439: 2025-10-30 02:03:39 <06932> RBP: 00007fffcff86840 RSP: 00007fffcff86810 440: 2025-10-30 02:03:39 <06932> RIP: 00007f220b436aed EFLAGS: 0000000000010293 441: 2025-10-30 02:03:39 <06932> CS: 0033 FS: 0000 GS: 0000 442: 2025-10-30 02:03:39 <06932> Trap: 000000000000000e Error: 0000000000000004 443: 2025-10-30 02:03:39 <06932> OldMask: 0000000000005a06 444: 2025-10-30 02:03:39 <06932> CR2: 00007f229eb87004 445: 2025-10-30 02:03:39 <06932> stack: 0x7fffcff86810 - 0x7fffcffce980 446: 2025-10-30 02:03:39 <06932> Backtrace: 447: 2025-10-30 02:03:39 <06932> [0x7f220b436aed] => /data/lib/libips.so {0x7f220b1e5000} 448: 2025-10-30 02:03:39 <06932> [0x7f220b4383d5] => /data/lib/libips.so {0x7f220b1e5000} 449: 2025-10-30 02:03:39 <06932> [0x7f220b42c38c] => /data/lib/libips.so {0x7f220b1e5000} 450: 2025-10-30 02:03:39 <06932> [0x7f220b3aeec9] => /data/lib/libips.so {0x7f220b1e5000} 451: 2025-10-30 02:03:39 <06932> [0x7f220b3af896] => /data/lib/libips.so {0x7f220b1e5000} 452: 2025-10-30 02:03:39 <06932> [0x7f220b3b0c50] => /data/lib/libips.so {0x7f220b1e5000} 453: 2025-10-30 02:03:39 <06932> [0x7f220b3b13a6] => /data/lib/libips.so {0x7f220b1e5000} 454: 2025-10-30 02:03:39 <06932> [0x7f220b3b816c] => /data/lib/libips.so {0x7f220b1e5000} 455: 2025-10-30 02:03:39 <06932> [0x7f220b3b4835] => /data/lib/libips.so {0x7f220b1e5000} 456: 2025-10-30 02:03:39 <06932> [0x7f220b9ef82e] => /data/lib/libips.so {0x7f220b1e5000} 457: 2025-10-30 02:03:39 <06932> [0x7f220b4a5cf8] => /data/lib/libips.so {0x7f220b1e5000} 458: 2025-10-30 02:03:39 <06932> [0x7f220b3b1666] => /data/lib/libips.so {0x7f220b1e5000} 459: 2025-10-30 02:03:39 <06932> [0x7f220b3b3c5f] => /data/lib/libips.so {0x7f220b1e5000} 460: 2025-10-30 02:03:39 <06932> [0x7f220b3c25b8] => /data/lib/libips.so {0x7f220b1e5000} 461: 2025-10-30 02:03:39 <06932> [0x7f220b2e9653] => /data/lib/libips.so {0x7f220b1e5000} 462: 2025-10-30 02:03:39 <06932> [0x7f221972a004] => /bin/ipsengine {0x7f2218504000} 463: 2025-10-30 02:03:39 <06932> [0x7f221971e571] => /bin/ipsengine {0x7f2218504000} 464: 2025-10-30 02:03:39 <06932> [0x7f22196fd8a9] => /bin/ipsengine {0x7f2218504000} 465: 2025-10-30 02:03:39 <06932> [0x7f220b5f97ee] => /data/lib/libips.so {0x7f220b1e5000} 466: 2025-10-30 02:03:39 <06932> [0x7f220b5e8eef] => /data/lib/libips.so {0x7f220b1e5000} 467: 2025-10-30 02:03:39 <06932> [0x7f221972449c] => /bin/ipsengine {0x7f2218504000} 468: 2025-10-30 02:03:39 <06932> [0x7f2218861af3] => /bin/ipsengine {0x7f2218504000} 469: 2025-10-30 02:03:39 <06932> [0x7f2211861e1b] => /lib/libc.so.6 {0x7f221183e000} 470: 2025-10-30 02:03:39 <06932> [0x7f221886100a] => /bin/ipsengine {0x7f2218504000} 471: 2025-10-30 02:03:39 <06932> fortidev 6.0.2.0008 472: 2025-10-30 02:03:39 [IPS Engine <06932>] base: 0x7f220b1e5000 473: 2025-10-30 02:03:39 [IPS Engine <06932>] Dissector statistics: 474: 2025-10-30 02:03:39 HTTP2 Dissector Statistics: Sessions | opened 1553300 confirmed 8 closed 475: 2025-10-30 02:03:39 1539274 Streams | opened 0 closed 0 closing 0 active 0 longest expiry 0 476: 2025-10-30 02:03:39 [IPS Engine <06932>] Last session info: 477: 2025-10-30 02:03:39 [IPS Engine <06932>] Session ID:1749558 Serial:252268854 Proto:6 Age:0 478: 2025-10-30 02:03:39 Idle:0 Flag:0x26 Feature:0x2 Ignore:0,0 Encap:0 479: 2025-10-30 02:03:39 [IPS Engine <06932>] Client: 10.65.25.83:42104 Server: 172.17.73.11:80 480: 2025-10-30 02:03:39 [IPS Engine <06932>] Stream: C-2800/2/2800, S-0/0/0 481: 2025-10-30 02:03:39 [IPS Engine <06932>] Service: http This issue has been resolved in IPSE versions 7.4:0589, 7.6:1158, 8.x:0004 Note: Contact Fortinet support if the FortiGate is running on an older IPSE versions. The 'diagnose autoupdate versions' command can be used to verify the IPS Attack Engine version.