7.6.0 WAD memory leak, Fortigate 200F

[bevvet]

So been running 7.6.0 since it has come out on my home fortigate. In 56 days the memory usage rose to about 83-84% when I just happened to log in and notice the high usage. 8 WAD services using about 13.3% usage each. Restarted WAD and memory dropped back down. Wanted to let the community know what I came across, don't have support on the fortigate so not able to open a ticket with them to provide them any information to help them discover the cause.

[ebilcari]

Thank you for sharing your findings. Are you using any policy in proxy mode?

There is a known issue (1042055) related to it, the issue is already fixed and will be included in 7.6.1.

[mpeddalla]

Hello  @bevvet ,

Thank you for contacting the Fortinet Forum portal.

-As mentioned by my colleague there is known issue but for time being if you would like to kill the wad process to optimize the memory configure the below automation stitch which helps to restart the wad process.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-restart-WAD-or-IPS-engine-using-aut...

Best regards,

Manasa.

If you feel the above steps helped resolve the issue, mark the reply as solved so that other customers can get it easily while searching for similar scenarios.

[viktor_k]

Hi here,

We have the same problem on the same devices. I have created a ticket for support, but conclusions are strange. Wait conserve mode and run test macros in production devices.

Restart processes doesn't help much. Only kill WAD processes with the most memory usage helps.

We had one policy with proxy mode. I have changed to Flow based, but it doesn't help.

Another strange moment. Support recommended to limit wad processes in config. I set it 8 and after restart WAD processes I have got around 18 processes. It is very strange.

We upgraded v7.2.7 -> 7.4.4.F -> 7.6.0.F . 7.2.7 version was stable. But now memory is rising around 1-2% per day.

Best regards,

Viktor