Suggestion for bad AV and IPS Defs

[seadave]

Over the years, those of us long time customers (I'm going on 13 years) have experienced the chaos that results from a bad definition or scan engine update.  The end result is a scanunit crash in the crashlog:

diag debug crashlog read

44: 2017-09-28 16:23:19 <01386> firmware FortiGate-500D v5.4.5,build1138b1138,170531 (GA) (Release) 45: 2017-09-28 16:23:19 <01386> application scanunit 46: 2017-09-28 16:23:19 <01386> *** signal 11 (Segmentation fault) received *** 47: 2017-09-28 16:23:19 <01386> AVDB 05004000AVDB00201-00051.00983-1709280015 48: 2017-09-28 16:23:19 <01386> ETDB 05004000AVDB00701-00051.00983-1709280015 49: 2017-09-28 16:23:19 <01386> EXDB 05004000AVDB00401-00001.00000-1210171547 50: 2017-09-28 16:23:19 <01386> AVSO 04000000AVEN00701052471705041426 51: 2017-09-28 16:23:19 <01386> Register dump: 52: 2017-09-28 16:23:19 <01386> RAX: 0000000000000000 RBX: 00007fff7d207e20 53: 2017-09-28 16:23:19 <01386> RCX: 00000000000000f8 RDX: 0000000012f14bba 54: 2017-09-28 16:23:19 <01386> R8: 00000000000000ff R9: 0000000000000000 55: 2017-09-28 16:23:19 <01386> R10: 0000000000000002 R11: 00007fb2939a184b 56: 2017-09-28 16:23:19 <01386> R12: 0000000000000046 R13: 00000000ffffffff 57: 2017-09-28 16:23:19 <01386> R14: 00007fff7d207e20 R15: 00007fff7d207d70 58: 2017-09-28 16:23:19 <01386> RSI: 0000000000000000 RDI: 0000000000000002 59: 2017-09-28 16:23:19 <01386> RBP: 00000000ffffffff RSP: 00007fff7d207c60 60: 2017-09-28 16:23:19 <01386> RIP: 00007fb2965cd827 EFLAGS: 0000000000010202 61: 2017-09-28 16:23:19 <01386> CS: 0033 FS: 0000 GS: 0000 62: 2017-09-28 16:23:19 <01386> Trap: 000000000000000e Error: 0000000000000004 63: 2017-09-28 16:23:19 <01386> OldMask: 0000000000000000 64: 2017-09-28 16:23:19 <01386> CR2: 0000000000000014

++++++++++++++++++++SNIP++++++++++++++++

Is it not possible to design a feature with some sort of daemon that watches for these events?  When a Def or Engine update occurs (perhaps I'm mistaken about Engine updates, I'm under the impression those are "pushed" just like AV and IPS Defs), the current one is saved in memory or on disk if available and if the daemon watching these events sees a scanunit crash, it reverts to the most recently replaced Engine or Def.  Perhaps that isn't possible with an Engine update but it seems like it should be for a Def.  Even if local resources precluded saving the previous version, it seems like a previous version could be downloaded from Fortinet servers.

This would greatly increase the stability of the platform IMHO.

Also I'd like to see a widget that displays the last 10 to 20 lines of the crashlog on the Dashboard.  This would alert admins to the presence of an issue as not everyone is aware of how to check via the CLI.

Thanks