New Diagnostic CLI for Monitoring Shared Signature Instances (8.0.0)
To reduce memory usage in large deployments, FortiWeb now supports shared instantiation of known-attack signature profiles. Instead of creating a separate memory structure for each use—even when the same profile is applied across multiple server policies—FortiWeb now reuses a single instance and tracks references internally.
To support visibility into this optimization, a new diagnostic CLI command has been added:
diagnose policy shared-waf-instance-on-non-CR-dmode WAF_SERVER_PROTECTION_RULE <adom-name> <profile-name>
Displays internal reference and policy binding data for the specified signature profile. Includes status, initialization result, reference counters, and a list of policies using the profile.
Example:
diagnose policy shared-waf-instance-on-non-CR-dmode show WAF_SERVER_PROTECTION_RULE root SIG is_enable: True process_init_status: Succeed module_config: 0x61400116ac40 update_counter: 0 ngid: 1298 ref_cnt: 2 pl_cnt: 2 policy[0]: serverpolicy policy[1]: serverpolicy_ws
-
diagnose policy shared-waf-instance-mode-on-non-CR-dmode show— Shows whether shared-instance mode is enabled. -
diagnose policy shared-waf-instance-mode-on-non-CR-dmode {enable | disable}— Enables or disables shared-instance mode globally for the WAF_SERVER_PROTECTION_RULE module.
These tools help administrators confirm whether FortiWeb is reusing signature profile instances correctly and allow efficient troubleshooting of reference states in memory-intensive environments.