Bug #6747
closed
pfctl - getting high cpu usage
Added by Rafael Cunha over 7 years ago.
Updated over 4 years ago.
Category:
Operating System
Description
When firewall logs is enabled on dashboard and update interval is set to a small time (5 seconds, ie), pfctl starts to get high cpu usage. This causes a packet loss problem.
Version 2.3.2-RELEASE (amd64)
built on Tue Jul 19 12:44:43 CDT 2016
FreeBSD 10.3-RELEASE-p5
The system is on the latest version.
CPU Type Intel(R) Xeon(R) CPU E5620 @ 2.40GHz
16 CPUs: 2 package(s) x 4 core(s) x 2 SMT threads
In case anyone need:
pfctl -sr | wc -l
8707
When pfblockerng counter widget is enabled too.
`-- sh -c /sbin/pfctl -vv -sr | /usr/bin/grep 'pfB_'
As discussed on IRC, his original pfctl usage was caused by the line below:
`-- sh -c /sbin/pfctl -vvPsr | /usr/bin/egrep '^@[0-9]+\\(1470855395\\)[[:space:]]pass[[:space:]].*[[:space:]]log[[:space:]]'
This seems to be responsible for reading rule descriptions, but as far as i can tell those are not shown on the widget anywhere.. Though are included in a 'data-content=' attribute for which i yet have to find any purpose on the widget.
Rafael will try and see if he edits the /usr/local/www/widgets/widgets/log.widget.php to nolonger read those descriptions if at least the first issue is 'gone'. And check if there are no negative sideeffects from that. If he confirms it works alright ill send a pullrequest removing it completely, if there are no objections ofc.. :).
Pi Ba, does this edition include pfblockerng widget problem too?
egrep is very memory aggressive...
The pfBlockerNG widget runs this line which doesn't use egrep:
pfctl -vv -sr | grep pfB
I don't think there is any concern for high cpu usage with the pfBlockerNG widget...
It only happens with firewall log widget and pfblockerng widget. The resources consumption (I'm not 100% sure if it's memory or cpu) gets high and pfSense starts losing packets. There's about 5000 hosts in this network and several rules. When I use command 'top' to monitor resources usage it's possible to see pfctl with high cpu usage.
Remove one widget at a time from the Dashboard and test with:
top -SH
Then see which is causing the high cpu usage. Let the top command run for a few minutes at a minimum...
- Category set to Operating System
- Status changed from New to Closed
Old report and no recent recurrences. Lots of things in this area have changed, so most likely it's either fixed no longer relevant.
Also available in: Atom
PDF
Updated by 
Updated by 
Updated by 
Updated by