where can I check this error?

[mauirixxx]

Earlier today, memory on my FT-60 went to around 86%, which effectively kills www/ftp access (dns and e-mail we' re still functioning though). I know running AV/AS and other features kills the memory on these, and since we bought the unit specifically for this function, turning it off isn' t something I want to do. In any case, here' s the system conserve mode error that popped up in my inbox:

type=event subtype=system pri=critical vd=root service=nntp sysconserve=on total=123 free=9 entermargin=10 exitmargin=20 msg=" The system has entered system conserve mode"

nntp? I have nothing in regards to nntp checked off or otherwise scanned on the unit. I ended up having to reset the unit in order to regain www/ftp functionality. thoughts on where to look, so I can keep this from happening again? Thanks everyone :)

[laf]

I don' t think NNTP crashed your unit. It' s just your equipment was overwhelmed by your network activity: - the equipment is too small for your network - there was a peak in network activity - you have a virus in your network that generates a lot of traffic, etc.

[mauirixxx]

I don' t think NNTP crashed your unit. It' s just your equipment was overwhelmed by your network activity: - the equipment is too small for your network

This caught my eye - is there a " rating" for how many devices the various units can handle? Right now, it' s protecting 13 workstations 6 laptops 11 servers 6 network printers (one of which runs an embedded NT 4.0) While I doubt that will overwhelm anything, we DO host our own e-mail, www, and ftp servers. I know our ftp servers get hit hard (bots trying to guess the non existant " Administrator" account & password), and we get our own share of spam via both connections. So then ... is it possible the unit is just overloaded? A peak in network activity, that could easily be attributed to us hosting our own services. If that' s the case, how can I recover without logging into the unit and resetting it? I also checked the entire network this morning for any potential virus - we also run Symantec Endpoint Protection (I' d rather have stayed with their " Corporate AV, but that' s a different matter), and I rechecked it' s running on all of our workstations & servers. Thanks for the response laf!

[laf]

Not much of a network for the FG 60. My only concern could be your 11 servers, don t know how many requests they re processing.... Anyway if you re to encounter this, you could use: execute router restart or diagnose sys session filter vd -1 diagnose sys session clear . Also make two week survey using SNMP and see the processor and memory usage during a work day. Off course there may be other solutions; how' s your Linux? We could try using some bots that will inform us about the traffic and session numbers offering us some graphic reports.

[mauirixxx]

I didn' t think that was too much network for the FT-60 either. The 60 blocks a ton of spam from both of our links (in a 29 day period - since our last reboot - it blocked over 9000 pieces of spam), but I know our FTP servers are just getting hammered by bots guessing the " administrator" password - before this reboot was were up to almost 60,000 ftp sessions in the last 29 day period. My Linux Fu is slowly coming along though. We run ESXi 3.5 on 2 different servers, and I still got memory / cpu / disc space to spare (I admit to falling into the " lets make a lot of virtual machines because we can" category initially - some of the excess servers are getting phased out). I' ve looked at mrtg and cacti, but they' re way over my head currently. I guess now would be a good time to *really* sit down and learn it. Thanks again for the tips laf. Got any advice on a good snmp program? Since the last time I attempted to run cacti and mrtg, I' ve enabled snmp on every Windows computer in the network as well, in hopes of monitoring my Exchange server.