Purpose
This article describes which general actions could be taken and which information should be sent to Fortinet Support in case of unexpectedly entry of the device into Conserve Mode.
Expectations, Requirements
Provide some suggestions to try to mitigate when a FortiGate device is entering in conserve mode unexpectedly and also to indicate the command to use to start the analysis.
Troubleshooting
FortiGate devices can enter in Proxy or Kernel mode when the memory-usage is higher than 70%, the features that consume the most memory being the IPS and the anti-virus.
So, if you notice that a FortiGate device enters in conserve mode, check if the profiles of the previously mentioned feature are enabled, also check if the profiles of these features are really needed in all policies where they are being used.
If not, disable them from the unneeded policies. If the profiles are really required, try to mitigate this issue by following the recommended actions described in the related KB.
Nevertheless, if the problem persists, use the following commands and send the output to Fortinet Support for analysis:
# get system status
# get system performance status <-- Use this commend three times leaving a time interval of 40 seconds to 1 minute between each execution
# diag sys top 2 40 <-- Let this command run for 40 seconds to 1 minute, then stop it via CTRL+C
# diag sys top-symmary <-- Let this command run for 40 seconds to 1 minute, then stop it via CTRL+C
# diag hard sysinfo memory
# diag hard sysinfo slab
# diag hard sysinfo shm
# get log disk setting
# get log disk filter
# get log memory setting
# get log memory filter
# diagnose hard sys conserve
# diag debug crashlog read
Related Articles
Technical Note : Best Practice for Fortinet Small Business models (FortiGate 30B, FortiGate 50B, For...
