Fortiswtich 81F and 81FWF (Wad process eating up memory) Firewall in High Conserve Mode

[JMOR]

Hi Team:

After several days, my users can't login via VPN as I see the box has gone into conservation mode.

Thus, I reset the WAD Process manually as I don't want to go to 7.61 as its manual.

So I'm using a script but this is not a good permanent solution.

So I do this: 

diagnose test application wad 99

config system auto-script

    edit restart_wad
        set interval 43200
        set repeat 100
        set start auto
        set script 'diagnose test application wad 99'
    next
end

Repeats every 24 Hours

Repeats 100 times

[abelio]

Hello Jmor
I guess you're talking about FGT 81F/ FWF81F as there's no switches with that model number

If you need right now a 'permanent solution', why don't you consider run your boxes with a mature release , like 7.4.5 or even 7.2.10 ?

As "downgrading"  firmware version is not advisable, I know that could be an extra job, a maintenance window, reconfiguration, etc, but you'll gain in better service for your users.

You don't need run the last last firmware version without check carefully Release Notes of the version.
For example, take a look on  https://docs.fortinet.com/document/fortigate/7.6.0/fortios-release-notes/236526/known-issues
There' re several known warnings on wad process under certain circumstances to consider.

I hope it helps

[BillH_FTNT]

Hi JMOR,

Please execute these commands multiple times to check what happened to your system. If you dont' mind please send the result to me through email bhoang@fortinet.com. I will check the issue. 

get sys status
diag sys top-mem 100
diagnose hardware sysinfo memory
diagnose hardware sysinfo shm
diagnose hardware sysinfo slab
diagnose sys process sock-mem
diagnose hardware sysinfo conserve
diagnose autoupdate versions
get sys performance status (run around 5 times)
get sys performance firewall statistics
get sys performance firewall packet-distribution
diagnose hardware sysinfo slab
diagnose sys session stat
diagnose hard sysinfo memory
diagnose hardware sysinfo shm
diagnose hardware deviceinfo disk
diagnose hard sysinfo interrupts
diagnose firewall statistic show
diagnose firewall packet distribution
diagnose test app proxyworker 4
diagnose ips session performance
diagnose test application ipsmonitor 1
diagnose ips session list
diagnose sys mpstat
diagnose sys top 2 99 ( Run it for 15 seconds and press q to quit)
diagnose sys top 2 99 (press 'm', let it run for 10 seconds, then press 'q' to quit)
execute tac report
diagnose debug enable
diagnose test app wad 1000
diagnose wad mem report
diagnose wad mem overused
diagnose wad mem track
diagnose wad memory workers
diagnose wad memory sum
diag user device stats
diag debug disable

[DPadula]

Hi JMOR,

Raise a case with our support and our TAC team will check the reason behind the WAD process is consuming memory. The script is a temporary solution keep the device stable while our team investigate the issue. As mentioned by another member of the forum, look for mature releases. Also I suggest to always check the release notes before any upgrade. 

Regards

DPadula