Memory leak in PF when retrieving Ethernet rules
In 2.7 and 22.05 the wired memory increases over time due to an apparent leak.
This appears to be in pf when it uses Ethernet rules. So it will impact installs running Captive Portal more visibly.
A fix for this has been submitted upstream:
Updated by Jim Thompson about 1 year ago
seems to have landed in our tree
as part of this merge, 2 days ago
Updated by Jim Pingle 12 months ago
- % Done changed from 0 to 100
I checked all around my lab and though I have captive portal enabled on numerous systems I couldn't find any that had evidence of a memory leak before or after the time when the fix went in. It's possible it requires a certain amount of user activity/churn to trigger, or at least a certain number of other config items (e.g. some number of Captive Portal allowed/blocked IP/FQDN/MAC entries?)
Would be nice if we had some idea of how to reproduce it reliably so we can confirm the fix.
Updated by jeroen van breedam 11 months ago
updated the system to 23.01 beta on sunday 15th
4 days later i can not notice any significant memory leak. wired memory increased less then 0.8%.
on 22.05 wired memory would have increased around 20% in the same time-frame.
i will keep a close eye on the problem the next couple of weeks.
screenshot of graphs attached
Updated by Jim Pingle 11 months ago
- Status changed from Feedback to Resolved
That seems like enough to call this resolved for now -- we can always revisit it if needed.
Unrelated to this issue (pf/memory leaking), but if you are using ZFS, you might want to restart one more time after the upgrade if you are monitoring memory usage closely for problems such as this. Post-upgrade, ZFS ARC will be consuming a larger amount of wired memory than usual due to all of the filesystem changes during the upgrade process. This is harmless in most cases as it will give up space as needed if there is memory pressure, but it can make monitoring usage as a whole trickier than it needs to be for watching usage patterns as in this situation. While it isn't isolated on the graph since it's lumped into "wired", you can monitor that usage via the
top command or Diagnostics > System Activity. If you are using UFS then that wouldn't apply.