Fortigate process " wad" consuming 62% of memory.

[plindgren]

i get the " CFG_CMDBAPI_ERR" when i try to make changes on my fortigate. which is other than that operational. I tired the command " diag test application ipsmonitor 99" but it did not work. So i used the command " diag sys top 1" to see what was hogging all that memory. And i found a process named " wad" that uses 62% of the memory. However this machine is in production and i dont know what the process does and i cant seem to find it anywhere. Can i kill it? What does it do? Is there a process reference for fortios out there somewhere?

[nikade87]

This was something that the support provided us with. We then applied in in Syste -> FortiGuard -> Upgrade Database.

[ispcolohost]

Just had the same exact issue with an HA pair of 200E's running 6.2.1; 'wad' processes were consuming 1.1+ gb each, and had stopped regular traffic forwarding to a couple virtual IP's.  Killed both processes, issue went away.  So.... years now and still not fixed apparently.  They'd been up for about a month.  Had been running 6.2 prior for several months without issue.

[nikade87]

Yeah the 'wad'-issue is a confirmed bug. I can see in our portal that the state of the ticket has been changed and is now in "Pend Bug Fix" so this is something that is known by Fortinet.

If you have support you could open a ticket and refer to ticket #3480359

[snobs]

FG-500E cluster with 6.2.2. WAD eating 12GB of RAM => conserve mode. Is there any workaround available?

Can someone help me creating a auto script? Something like

When memory is > 70% => reboot

(As it only boots one member of the cluster it should work)

[ispcolohost]

I'm still seeing it too even though support told me 6.2.2 fixes it...

[nikade87]

If you have support you should create a ticket and refer to this thread. There was some kind of fix which helped me. I havent had any issues since Fortinet Support helped me out.

[Heaven_Knows]

plindgren wrote:
i get the " CFG_CMDBAPI_ERR" when i try to make changes on my fortigate. which is other than that operational. I tired the command " diag test application ipsmonitor 99" but it did not work. So i used the command " diag sys top 1" to see what was hogging all that memory. And i found a process named " wad" that uses 62% of the memory. However this machine is in production and i dont know what the process does and i cant seem to find it anywhere. Can i kill it? What does it do? Is there a process reference for fortios out there somewhere?

pls view the current wad worker count and modify it 

    config global     config system global        set wad-worker-count (1,2,3,4...)     end

[Fiberops]

We are running a 301E with v6.0.4 and also having this issue. Just opened a ticket today.