Fortios 7.4.7 crash

[sys_pf]

Hi everyone,

In a few days we had some problems with FortiGate that stopped the log system and traffic; after that, the network communication was blocked, and to work normally, we had to reboot.

The crash log is that of this day.

2544: 2025-06-21 04:53:42 the killed daemon is /bin/updated: status=0x0
2545: 2025-06-21 04:53:42 the killed daemon is /bin/cloudapid: status=0x0
2546: 2025-06-21 04:53:43 the killed daemon is /bin/cloudapid: status=0x0
2547: 2025-06-21 04:53:45 the killed daemon is /bin/cu_acd: status=0x0
2548: 2025-06-21 04:55:13 the killed daemon is /bin/updated: status=0x0
2549: 2025-06-21 04:55:13 the killed daemon is /bin/cloudapid: status=0x0
2550: 2025-06-21 04:55:15 the killed daemon is /bin/cloudapid: status=0x0
2551: 2025-06-21 04:55:17 the killed daemon is /bin/updated: status=0x0
2552: 2025-06-21 04:55:17 the killed daemon is /bin/cloudapid: status=0x0
2553: 2025-06-21 04:55:18 the killed daemon is /bin/cu_acd: status=0x0
2554: 2025-06-21 04:55:18 the killed daemon is /bin/updated: status=0x0
2555: 2025-06-21 04:55:19 the killed daemon is /bin/cloudapid: status=0x0
2556: 2025-06-21 04:55:22 the killed daemon is /bin/updated: status=0x0
2557: 2025-06-21 04:55:23 the killed daemon is /bin/cloudapid: status=0x0
2558: 2025-06-21 04:55:24 the killed daemon is /bin/updated: status=0x0
2559: 2025-06-21 04:55:25 the killed daemon is /bin/cu_acd: status=0x0
2560: 2025-06-21 04:55:26 the killed daemon is /bin/updated: status=0x0
2561: 2025-06-21 04:55:28 the killed daemon is /bin/cloudapid: status=0x0
2562: 2025-06-21 04:55:29 the killed daemon is /bin/updated: status=0x0
2563: 2025-06-21 04:55:30 the killed daemon is /bin/cloudapid: status=0x0
2564: 2025-06-21 04:55:32 the killed daemon is /bin/cu_acd: status=0x0
2565: 2025-06-21 04:55:32 the killed daemon is /bin/updated: status=0x0
2566: 2025-06-21 04:55:32 the killed daemon is /bin/cloudapid: status=0x0
2567: 2025-06-21 04:55:34 the killed daemon is /bin/updated: status=0x0
2568: 2025-06-21 04:55:35 the killed daemon is /bin/cloudapid: status=0x0
2569: 2025-06-21 04:55:36 the killed daemon is /bin/updated: status=0x0
2570: 2025-06-21 04:55:37 the killed daemon is /bin/cloudapid: status=0x0
2571: 2025-06-21 04:55:38 the killed daemon is /bin/updated: status=0x0
2572: 2025-06-21 04:55:39 the killed daemon is /bin/cloudapid: status=0x0
2573: 2025-06-21 04:55:40 the killed daemon is /bin/cu_acd: status=0x0
2574: 2025-06-21 04:55:41 the killed daemon is /bin/updated: status=0x0
2575: 2025-06-21 04:55:42 the killed daemon is /bin/updated: status=0x0

Any suggestions on what's happening and how to fix this issue?

FortiGate

[atakannatak]

Hi @sys_pf ,

Several of the bug IDs listed below are resolved in FortiOS 7.4.8 and may be related to the issues you’re experiencing. Although they might not align perfectly with your scenario, I recommend verifying whether your current build is affected by these known issues and, if so, upgrading to version 7.4.8.

Bug ID : 1057131
Bug ID : 1113795, 1133386
Bug ID : 1095834
Bug ID : 1122741

https://docs.fortinet.com/document/fortigate/7.4.8/fortios-release-notes/289806/resolved-issues

A quick note on crash-log analysis: TAC support focuses on "break and fix" situations and does not provide RCA reports. These reports are offered as a paid service under our Advanced Services. You can find features of Advanced Support in the below brochure.

https://www.fortinet.com/content/dam/fortinet/assets/solution-guides/sb-forticare-services.pdf

BR.

If my answer provided a solution for you, please mark the reply as solved it so that others can get it easily while searching for similar scenarios.

CCIE #68781

[BillH_FTNT]

Hi sys_pf
I'm Bill from Fortinet. Could you please share more details about your issue with me via my official email: bhoang@fortinet.com ?
Please include the following information:
- Full output of the command: "diag debug crashlog read"
- System logs (preferably from FortiAnalyzer, syslog, etc.)
- Configuration file
- Hardware and software version
I will investigate your issue based on this information. Thank you!

Bill

[sys_pf]

Thanks to all,

I opened a support ticket and will wait for a response to inform you of the resolution.

[BillH_FTNT]

Thank you, I could get the information from ticket. 

Bill

[BillH_FTNT]

Hi sys_pf

I’ve reviewed the crash log attached to the ticket. It seems that the crash did not cause the firewall to reboot/shutdown. I believe the issue may be originating from another source.
Could you please export the logs to Excel from FortiAnalyzer, Syslog, or even from the local disk? We need to cross-check all events related to the firewall before and during the time of the issue.

Thank you,

Bill