miglogd Queue Buffer Accumulation during FortiAnalyzer Connectivity Loss
When remote FortiAnalyzer connectivity experiences packet loss or TCP handshake stalls, the FortiOS logging daemon miglogd queues unsent events into volatile RAM, expanding indefinitely until the appliance is locked into conserve mode.
Technical Root Cause Analysis
The FortiOS logging daemon miglogd collects event, traffic, and security logs from kernel ring buffers and dispatches them across encrypted OFTP/TLS tunnels to FortiAnalyzer. If the network circuit to FortiAnalyzer experiences degradation or an MTU blackhole, the sender's TCP socket buffer fills up.
In unpatched builds, miglogd lacks a dynamic RAM cap for queued messages. As hundreds of thousands of firewall session end logs generate, miglogd allocates new heap structures to buffer them in memory. Within 20–40 minutes, the process consumes 1.5GB+ of RAM, tripping the 88% Red conserve mode threshold.
Affected Firmware & Blast Radius Matrix
| FortiOS Branch | Vulnerable Builds | Confirmed Clean Build | Status & Workaround |
|---|---|---|---|
| FortiOS 7.0 | 7.0.0 – 7.0.13 | 7.0.14+ | Set buffer-drop-policy to discard old |
| FortiOS 7.2 | 7.2.0 – 7.2.5 | 7.2.6+ | Limit max-buffer-memory to 100MB |
| FortiOS 7.4 | 7.4.0 – 7.4.2 | 7.4.3+ | Enforce automated queue backpressure |
Platform Impact: Affects all enterprise firewalls forwarding high-volume traffic logs to remote cloud or off-site FortiAnalyzers over SD-WAN or IPsec tunnels.
Step 01: Free Verification CLI (Safe Read-Only)
Execute these commands to check miglogd queue backlog, memory consumption, and FortiAnalyzer reachability:
Diagnostic Commands
# 1. Inspect miglogd internal queue backlog and buffer stats
diagnose test application miglogd 6
# 2. Verify network reachability and SSL handshake to FortiAnalyzer
diagnose log fortianalyzer test-connectivity
# 3. Check memory ranking of miglogd process
diagnose sys top-mem | grep miglogd
# 4. Confirm process ID for surgical recycling
diagnose sys process pidof miglogdRemediation & Workaround Steps (Teaser Preview)
Unlock the complete non-disruptive buffer management runbook in the Ferrite interactive platform:
Frequently Asked Questions
Network latency or connectivity loss to FortiAnalyzer causes miglogd to buffer logs indefinitely in volatile RAM without a safety cap.
No, user traffic and hardware-accelerated sessions continue uninterrupted while the logging process respawns.
FortiOS 7.2.6 and 7.4.3 include automatic queue backpressure logic that prevents memory leaks during remote collector outages.