FortiGate 80E memory conserve mode

[IanB]

Hello folks

We look after various models of FortiGate and don't have a problem. Except for the 80E which regularly enters memory conserve mode and drops sessions. Occasionally getting so bad we have to contact the site to get someone to reboot it, as remote management isn't even possible.

We've tried firmware version 6.0.5, 6.0.6 and are now on 6.2.1 but the symptoms are largely unchanged. It usually runs okay for a couple of days to a week and then the alerts come through. Testing is difficult as I'm trying not to impact the site too much.

Has anyone experienced anything similar and found a solution that works? So far not much luck with Fortinet support...

[Macinator]

Yes - exactly the same issue here.

600D - Various versions of 6.2 and 6.2.1

I don't recall the issue on 6.0.5

No solution here, going to try support as well.

Scott

[sw2090]

conserve mode is sort of protection. Fortigates enter it when the run below 30% of free memory.

Maybe you should look into your FGT to see what causes this memory usage?

[Macinator]

Actually - I jumped on with Support last Friday - they took a long look and the ipsmonitor and wad were consuming unusual memory amounts.  My tech confirmed issues for some with 6.2 and 6.2.1 - 6.2.2 expected soon to address those issues.

He took a lot of logs and kicked it up to the next tier of support which I have not heard back from yet.

Killing the wad and ipsmonitor process helps short term but the memory does keep climbing - hopefully this will be enough to prevent having to reboot every three days.

Scott

[sw2090]

hm wasn't there annother ticket about wad consuming too much memory [in 6.x] recently?

[kphed]

sw2090 wrote:
hm wasn't there annother ticket about wad consuming too much memory [in 6.x] recently?

Having this issue on 5.6.11 VM02. Did you ever find a solution?

[aleilmago]

Hi.

When I had this issue in the past (a couple of times), the solution was the upgrade to the latest version of FortiOS.

Best.

Alessandro

[Dave_Hall]

From the CLI, perform a diag sys top (e.g. diag sys top 5 20) and see what processes are taking up memory.  (I can assume if you have a lot of content inspecting going, you may see multiple instances of ipsengine or scanunitd.) As a temp fix until the conserve mode issue is resolved there is always the option to daily reboot the fgt that should free up memory.

conf sys global set daily enable set restart 05:30 end