When a FortiGate enters conserve mode, users may report that new VPN connections or application requests are failing while some existing connections still work. Before restarting the firewall, capture its memory state while the problem is happening. A reboot can restore service temporarily, but the live process and session data you need to explain the incident will be gone.
This CLI-first guide starts with read-only checks. It shows how to distinguish a short-lived spike from sustained memory growth and what to collect for Fortinet TAC.
1. Confirm conserve mode and record the thresholds
Start a terminal capture and record the incident time, time zone, affected services, and HA member if applicable. Then run:
get system status
diagnose hardware sysinfo conserve
get system performance statusThe first command records the FortiOS build and device details. The second reports whether memory conserve mode is active and shows the thresholds on that device. The third gives you a snapshot of memory, CPU, session activity, and uptime.
| Threshold | Typical default | What it means |
|---|---|---|
| Green | 82% | Memory must fall below this threshold for the device to exit memory conserve mode. |
| Red | 88% | The device enters memory conserve mode when memory usage reaches this threshold. |
| Extreme | 95% | New sessions can be dropped at this level. |
Use the device’s actual thresholds during the incident. If the firewall entered conserve mode at 88% and then fell to 85%, it can still be in conserve mode because usage has yet to fall below the green threshold. Behavior below the extreme threshold also depends on the inspection path and relevant settings. For example, a proxy-inspected application may show symptoms before a simpler connectivity test fails.
FortiOS Administration Guide – Conserve mode · Fortinet – How conserve mode is triggered
2. Find out where the memory is going
Take two or three timestamped snapshots roughly one minute apart if the outage allows. Capture both system-wide memory and the top consumers at each interval.
get system performance status
diagnose sys top-mem 20
diagnose sys session statFor a short interactive process view, run the command below. Press m to sort by memory and q to exit.
diagnose sys top 2 40Compare the same process name and PID across samples. Record session count and setup rate at the same times so you can see whether process growth tracks demand.
| What you observe | What to check next |
|---|---|
A wad worker grows across samples | Check whether affected traffic uses proxy inspection. Correlate the trend with traffic volume and recent changes to inspection policies or profiles. |
One or more ipsengine workers grow | Compare inspected traffic and recent IPS or signature updates. Record the worker PIDs and exact engine and package versions. |
| Session activity rises sharply alongside memory | Use traffic logs or FortiAnalyzer to identify the busiest sources, destinations, or policies around the incident. |
| Total memory rises without a clear process outlier | Collect memory, kernel slab, and shared-memory diagnostics to give TAC more visibility. |
A large worker in a single sample is a clue. Sustained growth under comparable traffic is stronger evidence, but still needs investigation before you call it a memory leak.
Fortinet – Conserve mode due to IPS engine or WAD · Fortinet – Memory diagnostics
3. Build an incident timeline
Capture the outputs relevant to your findings. The first two commands help you correlate the incident with crash or conserve-mode records and FortiGuard component versions. The remaining commands are especially useful when process rankings fail to explain the increase.
diagnose debug crashlog read
diagnose autoupdate versions
diagnose hardware sysinfo memory
diagnose hardware sysinfo slab
diagnose hardware sysinfo shmIf WAD is the leading candidate and your build supports it, collect a WAD memory report:
diagnose wad memory reportCompare the timestamps with traffic spikes, FortiGuard updates, and configuration changes. An update that coincides with a short spike is worth checking. A process that keeps growing after traffic returns to baseline points the investigation in a different direction. For an HA cluster, label each capture with its member and role, and check peer health before considering a failover.
Fortinet – Initial troubleshooting of high memory utilization · Fortinet – Verify WAD during conserve mode · Fortinet – Conserve mode during FortiGuard updates
4. Decide whether to keep collecting or restore service
If memory is falling and users can still connect, take another sample and verify whether the firewall exits conserve mode below its green threshold. If memory keeps climbing and new connections are failing, take a short capture if the device responds, then follow your incident recovery procedure. For a standalone firewall, plan for the interruption a reboot will cause. In HA, confirm the peer is healthy and synchronized before an approved failover.
Treat threshold increases, fail-open changes, and process restarts as production changes. Raising thresholds gives the device less memory headroom. Changing fail-open behavior can change how traffic is inspected during the incident. A targeted restart can interrupt sessions handled by that process.
After recovery, verify that conserve mode is off and that new connections work through the affected services. Record the recovery time and compare the post-recovery baseline with your incident samples.
Example: Memory rises while session activity stays steady
Suppose the firewall is at 89% memory at 10:02 and 91% at 10:04. The session count and setup rate are roughly steady, but the same wad worker is larger in both samples. Users on a proxy-inspected policy report new HTTPS connections failing.
Capture the WAD report, the two process snapshots, the affected policy, and the FortiOS build. Check whether the first symptom lines up with an inspection profile change or a scheduled update. If a reboot is necessary to recover service, save the pre-reboot evidence so TAC can compare the worker’s behavior with known issues for that build.
What to send Fortinet TAC
- FortiGate model, exact FortiOS build, uptime, and HA member or role.
- Incident start and recovery times with time zone, affected services, and whether new connections failed.
- Conserve-mode status and thresholds, plus timestamped memory, process, and session snapshots.
- Relevant crash records, component versions, and process-specific diagnostics.
- Recent policy, firmware, or update changes and the outcome of any recovery action.
Share raw logs and configuration files through your support channel and handle any sensitive data under your organization’s procedures.
Frequently asked questions
Is high memory usage enough to confirm conserve mode?
Use diagnose hardware sysinfo conserve to verify the current state and thresholds. A single dashboard percentage cannot tell you whether the device already crossed the red threshold and is waiting to drop below green.
Does restarting the firewall fix conserve mode?
A restart can release memory and restore service. If traffic demand, capacity limits, or a software issue caused the pressure, the condition can recur. Compare the pre-restart samples with the post-recovery baseline to see how memory starts growing again.
Which command should I run first?
Run diagnose hardware sysinfo conserve, followed by get system performance status and diagnose sys top-mem 20. Together they show the current state, overall system load, and the largest visible process consumers.