System logs: warning - crash application scanunit

[anru]

Hi all,

in the recent days, in the system logs of FG-500D (HA: A-A) there's a lot of warning-crash messages as:

Pid: 24494, application: scanunit, Firmware: FortiGate-500D v6.0.1,build0131b0131,180604 (GA) (Release), Signal 11 received, Backtrace: [0x7f13a23a2130] [0x7f13a23a3197].

What could it be? Problems of AV files scanning?

Thanks!

[zotacno]

Hi Anru,

Same problem here. And we are running on a FG-500D (HA:A-P) running 6.0.3 release. This crash of the application scanunit happens about every 5 minutes.

Not sure yet what is causing this issue.

I would suggest raising a support ticket at Fortinet.

Kind regards

[Pep]

Hi guys,

Same here. 100E with 6.0.3 firmware. I had to reboot the firewall to make it work again. Couldn't access via web, very slow internet. Managed to SSH and reboot it. My guess is that CPU or RAM was exhausted. Managed to download the system logs and scanunit application started crashing around 10:00 am. By 14:40 users started reporting issues wiht the Internet connection.

This is the line. It repeated every minute or sometimes 5 times per minute until 18:00. 

Column 1 : date=2018-11-14 time=10:15:57 logid="0100032546" type="event" subtype="system" level="warning" vd="root" eventtime=1542190557 logdesc="Application crashed" action="crash" msg="Pid: 24741, application: scanunit, Firmware: FortiGate-100E v6.0.3,build0200b0200,181009 (GA) (Release), Signal 11 received, Backtrace: [0x00df290c] [0x34f06ab4]"

I will keep an eye whether carries on crashing or not. But do you know what scanunit application is? Is it the AV? Does it mean a bad signature installed this morning? 

Thanks,

[mike_dp]

We have the same issue with 6.0.3 300E A-P. It happens every 10 seconds or so. Anyone found a fix for this on 6.0.3?

[Pep]

Hi Mike, I did upgrade to 6.0.4 yesterday so if you have the opportunity it may sort your issue. They guys from support sent me an AV engine which I uploaded las November. That sorted my issue. I suggest to raise a ticket and they will come back to you. Thanks Jose

[anru]

anru wrote:
Hi all, in the recent days, in the system logs of FG-500D (HA: A-A) there's a lot of warning-crash messages as: Pid: 24494, application: scanunit, Firmware: FortiGate-500D v6.0.1,build0131b0131,180604 (GA) (Release), Signal 11 received, Backtrace: [0x7f13a23a2130] [0x7f13a23a3197].

Fortinet support sent me a new AV engine and I solved the problem.

Bye