The system has activated session fail mode

[#1]

Hi Guys, I am seeing a lot of " The system has activated session fail mode" and " The system has entered system conserve mode" several times during the night on one of our fortigate 200a firewalls. Does anyone know what would start causing this? Regards, Lee

[BrianPro]

I am seeing a lot of " The system has activated session fail mode" and " The system has entered system conserve mode" several times during the night on one of our fortigate 200a firewalls. Does anyone know what would start causing this?

I' m pretty sure this means you are maxing out the device for some reason. Could be anything from AV/IPS updates running at this time (they might consume more mem for a short period), some scheduled job on your network that requires high bandwidth or stresses the AV/IPS inspection, external accesses to your firewall eating up sessions, traffic peaks at this time, etc. I' d check the logs, CPU, memory around the times the log entries appear and see if you can nail it down. This KB gives more info : http://kb.fortinet.com/kb/microsites/microsite.do?cmd=displayKC&externalId=11076 it is for older OS versions, but still applies AFAIK. You may want to do more searches there to see if anything else pops.