Reduce memory use and avoid conserve mode

What this article covers

Memory reduction should begin with observation: identify what is consuming RAM and which features are required. Apply one controlled change at a time, monitor the response in a secondary telemetry window, and record the before-and-after result.

ScopeFortiGate units experiencing high memory utilisation, especially low-RAM desktop models (FG-40F/60F/80F) or clusters where memory use rises toward conserve-mode thresholds.

Before using the CLI

Dataplane Blast Radius Verify that transit traffic continues passing through hardware ASICs before adjusting control-plane memory settings.

Dual-Window Setup Open Window 1 for configuration changes and Window 2 running diagnose sys top-mem 20 to observe memory delta.

Baseline Snapshot Capture baseline memory before tuning: get system performance status and diagnose hardware sysinfo memory.

Troubleshooting workflow

Open Secondary SSH Window to observe memory trajectory

In Window 2, run continuous memory monitoring so you can observe the direct impact of configuration adjustments made in Window 1.

# [WINDOW 2 - SECONDARY LIVE TELEMETRY]
diagnose sys top-mem 20
diagnose hardware sysinfo conserve

Tune aggressive session timers to release stale RAM tables

In Window 1, lower TCP half-open, half-close, and UDP idle timers to accelerate stale connection table cleanup in memory.

# [WINDOW 1 - CONFIGURATION TUNING]
config system global
    set tcp-halfopen-timer 10
    set tcp-halfclose-timer 30
    set tcp-timewait-timer 10
    set udp-idle-timer 60
end

Migrate heavy policies from Proxy-based to Flow-based inspection

Flow mode bypasses WAD user-space worker memory footprints. Note: Starting in FortiOS 7.4.4+, proxy-mode inspection is completely deprecated on 2GB RAM models (FG-40F/60F/70F) to protect against memory exhaustion. For 2GB models, migrating to flow-based inspection is mandatory.

show firewall policy | grep "inspection-mode proxy"
config firewall policy
    edit <policy_id>
        set inspection-mode flow
    next
end

Optimise ISDB footprint & disable local RAM logging

Load minimal Internet Service Database definitions and redirect local event logging away from volatile system RAM to disk or FortiAnalyzer.

config system global
    set isdb-optimization mini
end
config log memory setting
    set status disable
end

Surgically restart confirmed leaking daemons with graceful SIGTERM

If Window 2 top-mem reveals a daemon (WAD/IPS) hoarding heap memory, issue graceful SIGTERM (diagnose sys kill 15 <pid>) to allow log queues and IPC shared memory locks to flush cleanly before recycling. Reserve forceful SIGKILL for unresponsive processes.

# Identify PID in Window 2 top-mem, then gracefully terminate:
diagnose sys kill 15 <pid>
# Fallback zero-downtime respawn if master daemon is hung:
fnsysctl killall wad
# If IPS engine is bloated:
diagnose test application ipsmonitor 99

Deploy low-memory automation stitch for proactive alerts

Configure an event-driven automation stitch to trigger instant diagnostic collection before the appliance enters conserve mode.

config system automation-trigger
    edit "low_memory_trigger"
        set event-type low-memory
    next
end
config system automation-action
    edit "snapshot_cli"
        set action-type cli-script
        set script "get sys perf stat
diagnose sys top-mem 20
diagnose hardware sysinfo slab"
    next
end
config system automation-stitch
    edit "stitch_low_mem"
        set trigger "low_memory_trigger"
        set actions "snapshot_cli"
    next
end

Operational caution

Review before applying: Changing inspection mode from proxy to flow alters certain deep-packet inspection behaviors (e.g. video filtering or explicit web proxy). Restarting WAD resets proxy TCP handshakes but maintains hardware-forwarded traffic.

Next step

Continue the evidence path

When WAD or IPS is the dominant consumer, use the dedicated WAD/IPS investigation article.

Explore Ferrite workflows Browse related articles