Conserve Mode Problem

[Mohamed_Khalaf]

Dears;

we need an urgent help, we are suffering from "Conserve mode" problem;

The memory and CPU most of the times over 70% which cause this problem but we didn't solve it yet although we did most of the troubleshooting steps which on the fortinet website.

Model: FortiGate 80C

Your quick response will be highly appreciated.

Regards;

Mohamed Khalaf IT Engineer

[gsarica]

Not sure what version firmware you're running but we had a similar issue. Fortinet support sent us an updated IPS engine which seems to have solved it for now. You might want to open a ticket with support to have them see if that would help.

[MikePruett]

Mohamed,

What version of FortiOS are you running? Have you tried removing UTM (or creating a test policy at the top of your policy set that has no UTM) and running with just that to see if CPU is still through the roof?

[Toshi_Esumi]

Have you checked diag sys top to see if any processes unreasonably holding huge memory? Then you might need to kill them.

http://kb.fortinet.com/kb....do?externalID=FD30531

[MikePruett]

Fairly certain IPS Engine will be the heavy hitter for him

[Mohamed_Khalaf]

Thanks for your replies; Iam using   v5.2.10,build742 (GA)

so I will try your suggestions and feed you back.

[Philippe_ASTIER]

Hi guys, I'm expecting similar issues on brand new FortiGate 61E running 5.4.3. So a respectable UTM.

Small traffic (4 Mb/s SDSL, about 300 sessions)

It started with AV-engine failing about 2 hours after starting it (and going through 9 mails..), so I disabled AV inspection.

Today, I tried Web filtering, and Conserve mode went back again after filtering just a few URLs, so I disabled it after reboot.

In both cases, the GUI would exhibit conserve mode, but CLI shows Conserve as... off.

At the same time , I can not change settings from the CLI, so it looks like it's really in Conserve.

Memory is at no more than 71%.

Really looks like a bug....

I'm running AV and web filtering on a much-smaller 30D in v5.2.7,build718, for 259 days without an issue !!

PS: 61E is very very fast, with a quad-core CPU and 2 GB RAM if I'm not wrong. So it's a bit disappointing !

[Mohamed_Khalaf]

Dear All,

Kindly note that i changed the Fortigate device with another one with the same model , and the surprise is it worked fine even with the same version.  so i'am telling you this problem probably a hardware problem. Regards.

[ITGuy11]

I also have a 60E at a branch office that was constantly going into conserve mode.  Working with support for months the only thing that seems to prevent the issue from occurring is to disable logging to memory, which is ridiculous.  There are at most 10 users at this site with a 100/20Mb internet connection and the device can't handle it without going into conserve mode utilizing the default UTM settings.  Very disappointing...

[MikePruett]

ITGuy11 wrote:

I also have a 60E at a branch office that was constantly going into conserve mode.  Working with support for months the only thing that seems to prevent the issue from occurring is to disable logging to memory, which is ridiculous.  There are at most 10 users at this site with a 100/20Mb internet connection and the device can't handle it without going into conserve mode utilizing the default UTM settings.  Very disappointing...

Are you logging every transaction for every policy?