What this article covers

Conserve mode is FortiOS's self-preservation mechanism when system RAM approaches exhaustion. However, silent packet drops can occur before conserve mode triggers if the Linux kernel fails to allocate memory pages (memory_tension_drop). This master runbook merges 6 authoritative Fortinet TAC and engineering sources to provide end-to-end triage from baseline confirmation to surgical daemon recycling and FortiOS 8.0 auto-scripts.

Scope & Firmware Matrix FortiGate hardware appliances & VM instances running FortiOS 7.0, 7.2, 7.4, and 8.0. Applies to enterprise networks managing high-throughput inspection, external threat feeds, and memory-constrained appliances (e.g. 2GB/4GB models).

Before using the CLI

Kernel Page Pressure vs Conserve Mode Check if the system is dropping packets silently due to Linux kernel page allocation failures (memory_tension_drop) even if conserve mode has not officially triggered.
Dataplane Fastpath Status Confirm that accelerated user transit traffic and IPsec tunnels continue passing normally through NP6/NP7/CP9 ASICs even while control-plane memory is under high pressure.
Out-of-Band Console Readiness Verify serial console cable (RJ-45 or USB-C, 9600 8-N-1) connectivity in the event that HTTPS web GUI or SSH management becomes sluggish during extreme conserve mode.

Troubleshooting workflow

01

Check current conserve state & hidden memory tension drops

Display active threshold states (Red, Extreme, Green) and verify whether the kernel is actively dropping transit packets due to memory tension before entering conserve mode.

diagnose hardware sysinfo conserve
diagnose sys session stat | grep memory_tension_drop
get system performance status
02

Step 02: Classify memory across the 5 core system subsystems

Determine whether memory consumption is driven by user-space daemons, kernel slab allocations (calculate bytes via num_objs × objsize), shared memory IPC segments, or disk I/O wait states.

🔒 Interactive CLI & Live Automation Available on Main Platform
03

Step 03: Fingerprint daemon anomalies & external threat feed regex bloat

Inspect top memory consumers like WAD (proxy/algo worker bloat from external threat feeds), IPS engine, bcm.user (switch fabric), or miglogd (logging queue backpressure).

🔒 Interactive CLI & Live Automation Available on Main Platform
04

Step 04: Execute non-disruptive mitigations & memory recovery

Reduce session timers, switch security profiles to Flow-mode, tune ISDB footprint to mini, and perform surgical zero-downtime daemon recycling without affecting hardware-offloaded NP7 traffic.

🔒 Interactive CLI & Live Automation Available on Main Platform
05

Step 05: Review default thresholds & apply tuned profile only if verified

FortiOS default thresholds: Red 88% (enter conserve), Extreme 95% (drop new sessions), Green 82% (exit conserve). Custom thresholds must be validated against hardware model and traffic profiles.

🔒 Interactive CLI & Live Automation Available on Main Platform
06

Step 06: Deploy FortiOS 8.0 auto-script diagnostics & TAC dossier

Automate snapshot diagnostic collection whenever log ID 0100032001 (enter conserve mode) fires so TAC Tier-3 escalation evidence is preserved before a reboot.

🔒 Interactive CLI & Live Automation Available on Main Platform
⚡ PLATFORM SUPERPOWERS UNLOCKED

Execute the Full 6-Step Runbook on the Ferrite Platform

Connect your FortiGate via browser console or SSH bridge, run live diagnostics with real-time checkoff, generate 1-click Tera Term macros, and export sanitized TAC escalation dossiers.

⚡
Live Browser Automation Web Serial (RJ-45 / USB-C) or local SSH bridge execution with live step-by-step checkoff.
📟
1-Click Tera Term Macro (.ttl) Export ready-to-run macro scripts with paging bypass (set output standard) and prompt sync.
🛡️
Zero-Trust Scrubber Sanitize serial numbers (FG*), public IPv4, and credentials in local browser memory.
📄
TAC P1 Escalation Dossier Generate standardized executive diagnostic dossiers with SHA-256 integrity verification seal.
🚀 Launch Full Interactive Runbook in Ferrite Suite → 🌐 Explore Ferrite Incident Platform
✓ Zero Software Install Required ✓ 100% In-Browser RAM Execution ✓ Zero Cloud Data Egress

Operational caution

Review before applying: Lowering thresholds causes protective actions (quarantine, session rejection, fail-open) to begin earlier. Raising thresholds reduces safety margin before kernel panic. Never raise thresholds to hide an active memory leak. Always capture diagnose sys top-mem and diagnose debug crashlog read before restarting daemons or rebooting.
Next step

Continue the evidence path

If the device is already in conserve mode, continue with the memory-reduction or process-isolation articles.

Next: Reduce Memory Use Runbook → Explore Main Platform