UTM Antivirus Event Log Suppression during Rapid Malware Attack Bursts
During automated worm outbreaks or ransomware mass encryption waves, FortiOS miglogd anti-flooding filters aggressively suppress repeat detection logs, creating audit discrepancies and blinding SOC correlation rules.
Technical Root Cause Analysis
When infected endpoints or malicious external bots attempt rapid file transfers containing polymorphic or repeat malware signatures (such as Emotet, LockBit loader payloads, or SMB worm propagation), FortiOS antivirus and IPS engines inspect each payload and correctly apply configured block actions.
However, when multiple files matching the same signature or originating from the same source IP hit the inspection daemon within a narrow sliding window (e.g. 5 seconds), miglogd invokes its anti-flooding rate-limiter algorithm. Under Bug 0898109, the rate-limiter suppresses not only the identical duplicates, but completely drops all subsequent detection logs for the remainder of the interval without emitting an aggregate log (e.g. "suppressed 450 repeat instances"). As a result, when an attacker fires 1,200 payload variants against an internal perimeter, the SIEM records only 3 to 5 isolated alerts. Forensics and incident responders analyzing SIEM logs conclude the attack was an isolated scan rather than an active, distributed credential theft or ransomware deployment, failing breach scope assessments under GDPR and HIPAA.
Affected Firmware & Blast Radius Matrix
| FortiOS Branch | Vulnerable Builds | Default Anti-Flooding Threshold | Remediation Strategy |
|---|---|---|---|
| FortiOS 7.2 | 7.2.2 – 7.2.6 | Aggressive (Drops unsummarized logs) | Disable repeat suppression in log setting |
| FortiOS 7.4 | 7.4.0+ Clean | Dynamic sliding window with summary counter | Default configuration safe |
| FortiOS 7.0 | 7.0.5 – 7.0.12 | Aggressive on high-IOPS desktop models | Adjust anti-flooding window CLI |
Platform Impact: All FortiGate clusters operating proxy or flow-mode AV/IPS inspection protecting high-throughput campus networks, email relays, and server farms.
Step 01: Free Verification CLI (Safe Read-Only)
Inspect current virus detection event streams and compare real-time inspection counters against disk logging statistics:
Diagnostic Commands
# 1. Inspect recent virus detection logs directly from local buffer
execute log filter category 0
execute log filter field subtype virus
execute log display
# 2. Check total UTM engine block counts vs recorded log records
diagnose log disk statistics
# 3. Audit anti-flooding configuration under log settings
show log setting | grep -E "anti-flooding|repeat"
# 4. Check active UTM inspection daemon process status
diagnose sys process pidof wadRemediation & Workaround Steps (Teaser Preview)
Follow the complete step-by-step remediation guide in the Ferrite interactive platform:
Frequently Asked Questions
The anti-flooding filter is intended to prevent denial-of-service on logging daemons and storage disks by collapsing or dropping rapid duplicate log lines generated by high-frequency network events.
Regulatory frameworks (PCI-DSS 10.2.4, HIPAA §164.312(b), SOC 2 CC7.2) require logging every occurrence of malicious code execution or detection. When 5,000 malware-laden emails or HTTP downloads are blocked in 60 seconds, suppressing 4,990 of the logs leads auditors to believe incident blast radius metrics were miscalculated or under-reported.
Administrators can tune 'config log setting' to set 'anti-flooding-threshold' higher or configure policy-specific UTM logging so high-priority security events bypass the global suppression table.