LogID 0100032001: System Entered Memory Conserve Mode (>88% RAM)
System memory utilization has breached the critical 88% red threshold, triggering protective conserve mode: FortiOS drops new proxy-inspected sessions, refuses admin GUI authentications, halts AV quarantine operations, and prevents configuration commits across all virtual domains.
Technical Root Cause Analysis
The FortiOS kernel conserve manager (conserve_mgr) continuously evaluates physical memory utilization against three predefined boundaries: Green (default 82%), Red (default 88%), and Extreme (default 95%).
When total utilized RAM exceeds 88%, the kernel emits logid="0100032001" and sets the global conserve mode flag. To shield critical OS processes from Linux kernel OOM killer termination, FortiOS immediately alters packet handling:
- New proxy-based TCP/UDP sessions are denied or bypassed depending on
av-failopenmode. - HTTP/HTTPS administrative sessions via Web GUI are refused (redirecting to a 503 Service Unavailable).
- Dynamic FortiGuard signature reloads and IPS database updates are suspended.
- Quarantine operations to local storage or memory queues are aborted.
Threshold Physics & Platform Impact Matrix
| Threshold Level | Default % RAM | System Operational Action | User Impact |
|---|---|---|---|
| Extreme Conserve | ≥ 95% | Drop ALL new sessions unconditionally | Catastrophic traffic blackout across all interfaces |
| Red Threshold | ≥ 88% | Enter Conserve Mode (LogID 0100032001) | Proxy drops, GUI lockout, AV failopen triggered |
| Green Threshold | ≤ 82% | Exit Conserve Mode (LogID 0100032002) | Full normal proxy & security inspection restored |
Platform Scope: Universal across all FortiGate models from entry-level desktop units (FG-40F/60F) to high-end enterprise appliances (FG-1000F to FG-3000F).
Step 01: Free Verification CLI (Safe Read-Only)
Execute these diagnostic commands to confirm whether the device is currently in conserve mode and identify top RAM-consuming processes:
Diagnostic Commands
# 1. Inspect exact physical memory utilization and kernel memory status
diagnose hardware sysinfo memory
# 2. Check the top 15 memory-consuming daemons and resident set sizes (RSS)
diagnose sys top-mem 15
# 3. Read kernel crashlog to detect conserve mode transition timestamps
diagnose debug crashlog read | grep conserve
# 4. Check active system session statistics and memory pressure flags
diagnose sys session statRemediation & Workaround Steps (Teaser Preview)
Follow the complete step-by-step remediation guide in the Ferrite interactive platform:
Frequently Asked Questions
When memory breaches the red threshold (default 88%), FortiOS enters conserve mode to prevent an unrecoverable kernel Out-Of-Memory (OOM) panic. The system blocks new proxy-inspected sessions, bypasses or drops AV scanning based on av-failopen configuration, suspends quarantine disk actions, and disables administrator web GUI logins.
By default, FortiOS enters conserve mode when total RAM breaches 88% (red threshold). If memory continues rising past 95% (extreme threshold), all new connections are unconditionally dropped. The firewall only exits conserve mode when memory drops below 82% (green threshold), enforcing a 6% hysteresis margin to prevent oscillation.
Executing 'diagnose test application wad 99' to gracefully cycle proxy worker processes, or restarting miglogd with 'fnsysctl killall miglogd', immediately releases hundreds of megabytes of user-space heap back to the kernel slab within seconds, exiting conserve mode cleanly.