What this article covers

Collect the evidence while the issue is present whenever possible. Enable terminal logging first so the command output is preserved in a single timestamped text file.

ScopeSystem engineers preparing an L3 or Fortinet TAC escalation for a high-memory or conserve-mode incident.

Before using the CLI

Dataplane Blast Radius Verify whether diagnostic CLI commands query control plane counters or inspect active ASIC session tables before execution.
Out-of-Band Access Ensure dedicated console cable or isolated management subnet is reachable if adjusting interface or routing parameters.
Baseline Snapshot Capture initial configuration checksums and performance statistics prior to applying operational changes.

Troubleshooting workflow

01

Capture overall system memory & kernel slab allocations

Record performance summary, detailed RAM distribution, and calculate kernel slab memory (num_objs × objsize) and IPC shared memory sizing.

get system performance status
diagnose hardware sysinfo memory
diagnose hardware sysinfo slab
diagnose hardware sysinfo shm
02

Capture process memory & inspect core pinning

Record the largest consumers and a repeated process sample. In diagnose sys top, press Shift+M to sort by memory, Shift+P to sort by CPU, and inspect the CPU column for single-core worker pinning.

diagnose sys top-mem 20
diagnose sys top 2 50
# Inside top: Shift+M (sort RAM), Shift+P (sort CPU)
03

Capture sessions, conserve status & hidden memory tension drops

Record active session statistics, verify conserve mode status, and check memory_tension_drop for silent session drops caused by page allocation failures before conserve mode triggers.

diagnose sys session stat
diagnose sys session stat | grep memory_tension_drop
diagnose hardware sysinfo conserve
04

Capture crash history

Include recent crash and process-termination evidence.

diagnose debug crashlog read
05

Save and label the output

Export the terminal session to a text file. Include the incident timestamp, timezone, device alias, model and whether user traffic was affected.

Operational caution

Review before applying: Diagnostic output may contain addresses, hostnames, serial numbers and configuration details. Apply the organisation's handling and redaction policy before sharing.
Next step

Continue the evidence path

Upload the collected text file to Ferrite so the evidence manifest can check what is present and what remains missing.

Explore Ferrite workflows Browse related articles