FortiAnalyzer Disk Quota Enforcement Silently Discarding Security Logs
When configured ADOM disk storage reaches maximum quota, the FortiAnalyzer faz_quota_mgr process locks into an emergency drop state instead of performing automated FIFO log rolling, silently rejecting incoming FortiGate event and traffic logs without alert triggers.
Technical Root Cause Analysis
In enterprise deployments, FortiGates stream encrypted audit trails over the Fortinet OFTP/SSL transport layer to an on-premise FortiAnalyzer cluster. Each device or Administrative Domain (ADOM) is assigned a maximum storage quota (e.g., 500GB) with an enforcement policy configured to overwrite oldest logs once utilization surpasses 90–95%.
Under Bug 0892902, when continuous write throughput coincides with complex background SQL index compression, a mutex deadlock occurs inside faz_quota_mgr. The quota evaluation daemon flags the storage container as hard-locked (100% full) but fails to dispatch the deletion worker task. Consequently, FortiAnalyzer responds to incoming OFTP batch transmissions with application-level reject codes. On the FortiGate side, miglogd detects backpressure and drops unsent event buffers. Because the underlying TCP connection remains established, the FortiGate dashboard displays a deceptive green "Connected" status while weeks of compliance telemetry evaporate.
Affected Firmware & Blast Radius Matrix
| FAZOS Branch | Vulnerable Builds | Confirmed Clean Build | Status & Workaround |
|---|---|---|---|
| FAZOS 7.4 | 7.4.0 – 7.4.2 | 7.4.3+ | Reduce retention ratio, re-index ADOM database |
| FAZOS 7.2 | 7.2.0 – 7.2.5 | 7.2.6+ | Tune quota alert trigger to 80% to avoid deadlock |
| FAZOS 7.0 | 7.0.4 – 7.0.10 | 7.0.11+ | Apply manual SQL vacuum & disk expand |
Platform Impact: All on-prem physical FAZ appliances (FAZ-300F to 3700G) and FAZ-VM instances hosting multi-VDOM enterprise FortiGate estates.
Step 01: Free Verification CLI (Safe Read-Only)
Run these diagnostic commands on your FortiGate to verify whether your FortiAnalyzer is currently accepting or silently rejecting audit events:
Diagnostic Commands
# 1. Check live FortiAnalyzer connectivity and rejection counters
diagnose log fortianalyzer status
# 2. Inspect miglogd internal queue saturation and drop statistics
diagnose test application miglogd 6
# 3. Check local disk-quota state on units with internal SSD logging
execute log disk-quota status
# 4. Filter kernel log for remote collector backpressure warnings
diagnose log kernel-log | grep -i "oftp"Remediation & Workaround Steps (Teaser Preview)
Follow the complete step-by-step remediation guide in the Ferrite interactive platform:
Frequently Asked Questions
Under Bug 0892902, a race condition in the FAZ quota manager daemon (faz_quota_mgr) deadlocks when high write IOPS coincide with automatic archive pruning. The disk quota daemon flags the storage container as full and rejects the FortiGate OFTP stream instead of recycling oldest indexed SQL blocks.
No. In the FortiGate GUI, the FortiAnalyzer connection typically shows a green checkmark because the TCP/SSL handshake completes, even though miglogd discard counters increment silently in the background.
The quota manager deadlock is resolved in FAZOS 7.2.6, 7.4.3, and all 7.6 builds through an asynchronous garbage collection pipeline.