Diskless FortiGate 60F Log Queue Overflow Silently Discarding Event Records
Desktop diskless FortiGate appliances (FG-40F, FG-60F, FG-70F) buffering logs in volatile memory silently purge security, UTM, and admin event records during WAN outages once the fixed RAM ring buffer saturates.
Technical Root Cause Analysis
Entry-level desktop appliances such as the FG-40F, FG-60F, and FG-70F feature 2GB of system RAM and lack onboard SSD storage. Consequently, FortiOS implements an in-memory ring buffer (miglogd_mem_ring) sized conservatively (between 16MB and 32MB) to stage outgoing event and traffic logs destined for remote FortiAnalyzer or syslog collectors.
When an upstream WAN circuit fails or SD-WAN tunnels flap, miglogd enters buffering mode. In retail branches or distributed branch offices with active guest Wi-Fi and employee internet traffic, this small volatile ring buffer fills within 180 to 300 seconds. Under Bug 0876104, when the ring buffer reaches high-water mark (98%), miglogd defaults to a FIFO head-drop policy without emitting an SNMP trap or incrementing user-visible alert counters. High-priority security logs—such as malware blocks, unauthorized admin login attempts, and IPS alerts—are overwritten by noisy DNS session-end logs. Once WAN connectivity recovers, the firewall syncs only the most recent couple of minutes of traffic, creating irrecoverable gaps in compliance audit trails.
Affected Firmware & Hardware Architecture
| Hardware Family | Storage Architecture | Volatile Buffer Limit | Risk & Mitigation |
|---|---|---|---|
| FG-40F / FG-40F-3G4G | Diskless (2GB RAM, 4GB eMMC OS only) | 16 MB fixed buffer | Suppress traffic logs; prioritize UTM only |
| FG-60F / FG-61F | FG-60F Diskless / FG-61F has 128GB SSD | FG-60F: 32 MB buffer (Vulnerable) | FG-61F unaffected if logging to disk |
| FG-70F / FG-71F | FG-70F Diskless / FG-71F has 128GB SSD | FG-70F: 32 MB buffer (Vulnerable) | Tune logfilter to discard session start |
Platform Impact: All diskless desktop appliances deployed at retail sites, bank branches, and remote facilities operating under strict audit frameworks (PCI-DSS, ISO 27001).
Step 01: Free Verification CLI (Safe Read-Only)
Check your diskless appliance's logging daemon status, memory queue limits, and dropped log statistics:
Diagnostic Commands
# 1. Query miglogd memory queue depth and drop counters
diagnose test application miglogd 6
# 2. Inspect kernel log messages for buffer overflow and drop notices
diagnose log kernel-log | grep -E "miglogd|drop|overflow"
# 3. Check memory consumption of the logging daemon
diagnose sys top-mem | grep miglogd
# 4. Verify remote logging destination reachability and status
diagnose log fortianalyzer statusRemediation & Workaround Steps (Teaser Preview)
Follow the complete step-by-step remediation guide in the Ferrite interactive platform:
Frequently Asked Questions
Models without an internal SSD (FG-40F, FG-60F, FG-70F) allocate a strict 16MB to 32MB slice of volatile RAM for log buffering to prevent running out of system memory. When the WAN goes down and remote FortiAnalyzer/syslog destinations become unreachable, this ring buffer fills within 2 to 5 minutes of moderate traffic, triggering tail drops.
Under Bug 0876104, when the ring buffer reaches maximum capacity, miglogd invokes a silent discard routine rather than logging an event message, because generating a log message about a full log buffer would recursively exacerbate the buffer overflow.
Administrators must filter out low-value traffic logs, configure SD-WAN packet duplication for syslog traffic, or route high-priority audit events over an out-of-band cellular tunnel.