Thank you @johnpoz I always use zfs, neve had any memory issues, the only issue I had with similar consumption was an ipsec bug rectified in 2.6 CE (I run + version atm), the VM does not even have lan, it's purely ipsec gateway to public ip, with only about 3 rules and acme package, that's it, here is ram usage after reboot less then 30% CPU Activity last pid: 89949; load averages: 0.90, 0.79, 0.67 up 0+04:23:16 18:13:24 243 threads: 2 running, 221 sleeping, 20 waiting CPU: 0.2% user, 0.2% nice, 0.5% system, 0.0% interrupt, 99.0% idle Mem: 39M Active, 126M Inact, 201M Wired, 561M Free ARC: 84M Total, 20M MFU, 60M MRU, 280K Anon, 618K Header, 2709K Other 60M Compressed, 137M Uncompressed, 2.30:1 Ratio Swap: 2048M Total, 2048M Free PID USERNAME PRI NICE SIZE RES STATE TIME WCPU COMMAND 11 root 187 ki31 0B 16K RUN 260:28 100.00% [idle] 0 root -16 - 0B 1120K swapin 5294.0 0.00% [kernel{swapper}] 0 root -12 - 0B 1120K - 0:10 0.00% [kernel{z_wr_iss}] 0 root -16 - 0B 1120K - 0:03 0.00% [kernel{z_wr_int}] 12 root -64 - 0B 304K WAIT 0:03 0.00% [intr{irq25: virtio_pci0}] 2 root -60 - 0B 16K WAIT 0:03 0.00% [clock] 7 root -16 - 0B 16K pftm 0:03 0.00% [pf purge] 6 root -8 - 0B 624K tx->tx 0:02 0.00% [zfskern{txg_thread_enter}] 32039 root 20 0 13M 2868K nanslp 0:02 0.00% /usr/local/bin/dpinger -S -r 0 -i ISP_v6 -B 2a10:9200:1:26f:: -p /var/run/dpinger_ISP_v6~2a10:9200:1:26f::~2606:4700:4700::1112.pid -u /var/run/dpinger_ISP_v6~2a10:9200:1:26f::~2606:4700:4700::1112.sock -C /etc/rc.gateway_alarm -d 1 -s 500 -l 2000 -t 60000 -A 1000 -D 500 -L 20 2606:4700:4700::1112{dpinger} 9 root -16 - 0B 48K psleep 0:02 0.00% [pagedaemon{dom0}] 31663 root 20 0 13M 2864K nanslp 0:02 0.00% /usr/local/bin/dpinger -S -r 0 -i ISP_v4 -B 77.232.39.159 -p /var/run/dpinger_ISP_v4~77.232.39.159~1.1.1.2.pid -u /var/run/dpinger_ISP_v4~77.232.39.159~1.1.1.2.sock -C /etc/rc.gateway_alarm -d 1 -s 500 -l 2000 -t 60000 -A 1000 -D 500 -L 20 1.1.1.2{dpinger} 8 root -16 - 0B 16K - 0:02 0.00% [rand_harvestq] 38074 root 20 0 13M 2988K select 0:01 0.00% /usr/sbin/syslogd -O rfc3164 -s -c -c -l /var/dhcpd/var/run/log -P /var/run/syslog.pid -f /etc/syslog.conf 43017 root 20 0 17M 6968K select 0:01 0.00% /usr/local/sbin/ntpd -g -c /var/etc/ntpd.conf -p /var/run/ntpd.pid{ntpd} 16726 root 68 20 13M 2888K wait 0:01 0.00% /bin/sh /var/db/rrd/updaterrd.sh 17504 root 20 0 13M 3620K bpf 0:01 0.00% /usr/local/sbin/filterlog -i pflog0 -p /var/run/filterlog.pid 48967 root 68 0 146M 49M accept 0:01 0.00% php-fpm: pool nginx (php-fpm){php-fpm} 362 root 68 0 146M 48M accept 0:01 0.00% php-fpm: pool nginx (php-fpm){php-fpm} 83490 root 20 0 146M 47M piperd 0:01 0.00% php-fpm: pool nginx (php-fpm){php-fpm} 12 root -64 - 0B 304K WAIT 0:01 0.00% [intr{irq28: virtio_pci1}] 0 root -16 - 0B 1120K - 0:01 0.00% [kernel{z_null_iss}] 43658 root 20 0 31M 10M kqread 0:01 0.00% nginx: worker process (nginx) 88490 root 68 0 146M 47M accept 0:01 0.00% php-fpm: pool nginx (php-fpm){php-fpm} 85669 root 68 0 117M 43M accept 0:00 0.00% php-fpm: pool nginx (php-fpm){php-fpm} 359 root 20 0 111M 30M kqread 0:00 0.00% php-fpm: master process (/usr/local/lib/php-fpm.conf) (php-fpm) 90594 root 68 0 117M 42M accept 0:00 0.00% php-fpm: pool nginx (php-fpm){php-fpm} 32039 root 20 0 13M 2868K sbwait 0:00 0.00% /usr/local/bin/dpinger -S -r 0 -i ISP_v6 -B 2a10:9200:1:26f:: -p /var/run/dpinger_ISP_v6~2a10:9200:1:26f::~2606:4700:4700::1112.pid -u /var/run/dpinger_ISP_v6~2a10:9200:1:26f::~2606:4700:4700::1112.sock -C /etc/rc.gateway_alarm -d 1 -s 500 -l 2000 -t 60000 -A 1000 -D 500 -L 20 2606:4700:4700::1112{dpinger} 92710 root 68 0 117M 42M accept 0:00 0.00% php-fpm: pool nginx (php-fpm){php-fpm} 6 root -8 - 0B 624K - 0:00 0.00% [zfskern{dp_sync_taskq}] 12 root -60 - 0B 304K WAIT 0:00 0.00% [intr{swi1: netisr 0}] 31663 root 20 0 13M 2864K sbwait 0:00 0.00% /usr/local/bin/dpinger -S -r 0 -i ISP_v4 -B 77.232.39.159 -p /var/run/dpinger_ISP_v4~77.232.39.159~1.1.1.2.pid -u /var/run/dpinger_ISP_v4~77.232.39.159~1.1.1.2.sock -C /etc/rc.gateway_alarm -d 1 -s 500 -l 2000 -t 60000 -A 1000 -D 500 -L 20 1.1.1.2{dpinger} 13405 root 20 0 49M 21M select 0:00 0.00% /usr/local/libexec/ipsec/charon --use-syslog{charon} 16 root -60 - 0B 80K - 0:00 0.00% [usb{usbus0}] 32039 root 20 0 13M 2868K nanslp 0:00 0.00% /usr/local/bin/dpinger -S -r 0 -i ISP_v6 -B 2a10:9200:1:26f:: -p /var/run/dpinger_ISP_v6~2a10:9200:1:26f::~2606:4700:4700::1112.pid -u /var/run/dpinger_ISP_v6~2a10:9200:1:26f::~2606:4700:4700::1112.sock -C /etc/rc.gateway_alarm -d 1 -s 500 -l 2000 -t 60000 -A 1000 -D 500 -L 20 2606:4700:4700::1112{dpinger} 31663 root 20 0 13M 2864K nanslp 0:00 0.00% /usr/local/bin/dpinger -S -r 0 -i ISP_v4 -B 77.232.39.159 -p /var/run/dpinger_ISP_v4~77.232.39.159~1.1.1.2.pid -u /var/run/dpinger_ISP_v4~77.232.39.159~1.1.1.2.sock -C /etc/rc.gateway_alarm -d 1 -s 500 -l 2000 -t 60000 -A 1000 -D 500 -L 20 1.1.1.2{dpinger} 4 root -16 - 0B 48K - 0:00 0.00% [cam{scanner}] 13405 root 20 0 49M 21M uwait 0:00 0.00% /usr/local/libexec/ipsec/charon --use-syslog{charon} 6 root -8 - 0B 624K dbuf_e 0:00 0.00% [zfskern{dbuf_evict_thread}] 12260 root 20 0 13M 3288K usem 0:00 0.00% /usr/local/sbin/filterdns -p /var/run/filterdns-ipsec.pid -i 60 -c /var/etc/ipsec/filterdns-ipsec.hosts -d 1{local-pfsense.cloud} 42334 root 21 0 13M 2660K nanslp 0:00 0.00% /usr/sbin/cron -s 0 root -16 - 0B 1120K - 0:00 0.00% [kernel{z_rd_int}] 13405 root 20 0 49M 21M uwait 0:00 0.00% /usr/local/libexec/ipsec/charon --use-syslog{charon} 13405 root 20 0 49M 21M select 0:00 0.00% /usr/local/libexec/ipsec/charon --use-syslog{charon} 13405 root 20 0 49M 21M uwait 0:00 0.00% /usr/local/libexec/ipsec/charon --use-syslog{charon} 6 root -8 - 0B 624K mmp->m 0:00 0.00% [zfskern{mmp_thread_enter}] 13405 root 20 0 49M 21M uwait 0:00 0.00% /usr/local/libexec/ipsec/charon --use-syslog{charon} 19 root 16 - 0B 16K syncer 0:00 0.00% [syncer] 13405 root 20 0 49M 21M uwait 0:00 0.00% /usr/local/libexec/ipsec/charon --use-syslog{charon} 13405 root 20 0 49M 21M uwait 0:00 0.00% /usr/local/libexec/ipsec/charon --use-syslog{charon} 13405 root 20 0 49M 21M uwait 0:00 0.00% /usr/local/libexec/ipsec/charon --use-syslog{charon} 13405 root 20 0 49M 21M uwait 0:00 0.00% /usr/local/libexec/ipsec/charon --use-syslog{charon} 6 root -8 - 0B 624K t->zth 0:00 0.00% [zfskern{arc_reap}] 13405 root 20 0 49M 21M uwait 0:00 0.00% /usr/local/libexec/ipsec/charon --use-syslog{charon} 13405 root 20 0 49M 21M uwait 0:00 0.00% /usr/local/libexec/ipsec/charon --use-syslog{charon} 13405 root 20 0 49M 21M uwait 0:00 0.00% /usr/local/libexec/ipsec/charon --use-syslog{charon} 13405 root 20 0 49M 21M uwait 0:00 0.00% /usr/local/libexec/ipsec/charon --use-syslog{charon} 13405 root 20 0 49M 21M uwait 0:00 0.00% /usr/local/libexec/ipsec/charon --use-syslog{charon} 13405 root 20 0 49M 21M uwait 0:00 0.00% /usr/local/libexec/ipsec/charon --use-syslog{charon} 0 root 8 - 0B 1120K - 0:00 0.00% [kernel{thread taskq}] 20 root -16 - 0B 16K vlruwt 0:00 0.00% [vnlru] 6 root -8 - 0B 624K l2arc_ 0:00 0.00% [zfskern{l2arc_feed_thread}] 0 root -16 - 0B 1120K - 0:00 0.00% [kernel{z_null_int}] 0 root -16 - 0B 1120K - 0:00 0.00% [kernel{z_ioctl_int}] 18 root -16 - 0B 32K psleep 0:00 0.00% [bufdaemon{bufdaemon}] 13405 root 68 0 49M 21M sigwai 0:00 0.00% /usr/local/libexec/ipsec/charon --use-syslog{charon} 18 root -16 - 0B 32K - 0:00 0.00% [bufdaemon{bufspacedaemon-0}] 9 root -16 - 0B 48K umarcl 0:00 0.00% [pagedaemon{uma}] 6 root -16 - 0B 624K - 0:00 0.00% [zfskern{metaslab_group_task}] 6 root -8 - 0B 624K tx->tx 0:00 0.00% [zfskern{txg_thread_enter}] 39251 root 20 0 14M 4124K usem 0:00 0.00% /usr/local/sbin/filterdns -p /var/run/filterdns.pid -i 300 -c /var/etc/filterdns.conf -d 1{nevolex.float-zone.} 1 root 20 0 11M 1228K wait 0:00 0.00% [init] 39251 root 20 0 14M 4124K usem 0:00 0.00% /usr/local/sbin/filterdns -p /var/run/filterdns.pid -i 300 -c /var/etc/filterdns.conf -d 1{nevolex.fortidyndns} 39251 root 20 0 14M 4124K usem 0:00 0.00% /usr/local/sbin/filterdns -p /var/run/filterdns.pid -i 300 -c /var/etc/filterdns.conf -d 1{ngfw.hopto.me} 6 root -8 - 0B 624K - 0:00 0.00% [zfskern{dp_zil_clean_taskq}] 32039 root 20 0 13M 2868K accept 0:00 0.00% /usr/local/bin/dpinger -S -r 0 -i ISP_v6 -B 2a10:9200:1:26f:: -p /var/run/dpinger_ISP_v6~2a10:9200:1:26f::~2606:4700:4700::1112.pid -u /var/run/dpinger_ISP_v6~2a10:9200:1:26f::~2606:4700:4700::1112.sock -C /etc/rc.gateway_alarm -d 1 -s 500 -l 2000 -t 60000 -A 1000 -D 500 -L 20 2606:4700:4700::1112{dpinger} 31663 root 20 0 13M 2864K accept 0:00 0.00% /usr/local/bin/dpinger -S -r 0 -i ISP_v4 -B 77.232.39.159 -p /var/run/dpinger_ISP_v4~77.232.39.159~1.1.1.2.pid -u /var/run/dpinger_ISP_v4~77.232.39.159~1.1.1.2.sock -C /etc/rc.gateway_alarm -d 1 -s 500 -l 2000 -t 60000 -A 1000 -D 500 -L 20 1.1.1.2{dpinger} 517 root 20 0 11M 1596K select 0:00 0.00% /sbin/devd -q -f /etc/pfSense-devd.conf 0 root -60 - 0B 1120K - 0:00 0.00% [kernel{softirq_0}] 89721 root 68 0 13M 3304K wait 0:00 0.00% -sh (sh) 87392 root 68 0 13M 2940K wait 0:00 0.00% login [pam] (login) 0 root -16 - 0B 1120K - 0:00 0.00% [kernel{z_wr_iss_h_2}] 75559 root 20 0 12M 2232K nanslp 0:00 0.00% minicron: helper /usr/local/bin/ping_hosts.sh (minicron) 76517 root 68 0 12M 2232K nanslp 0:00 0.00% minicron: helper /usr/local/bin/ipsec_keepalive.php (minicron) 0 root -8 - 0B 1120K - 0:00 0.00% [kernel{system_taskq}] 6 root -8 - 0B 624K - 0:00 0.00% [zfskern{dbu_evict}] 0 root -16 - 0B 1120K - 0:00 0.00% [kernel{z_wr_int_h_4}] 14 root -8 - 0B 48K - 0:00 0.00% [geom{g_event}] 390 root 52 20 13M 2964K kqread 0:00 0.00% /usr/local/sbin/check_reload_status 89949 root 20 0 14M 3644K RUN 0:00 0.00% /usr/bin/top -baHS 999 49762 root 24 0 13M 3020K wait 0:00 0.00% /bin/sh /usr/local/sbin/sshguard -i /var/run/sshguard.pid 50476 root 21 0 13M 2900K piperd 0:00 0.00% /usr/local/libexec/sshg-blocker{sshg-blocker} 92496 root 68 0 13M 3032K ttyin 0:00 0.00% /bin/sh /etc/rc.initial 50476 root 20 0 13M 2900K nanslp 0:00 0.00% /usr/local/libexec/sshg-blocker{sshg-blocker} 0 root -60 - 0B 1120K - 0:00 0.00% [kernel{mca taskq}] 50771 root 31 0 13M 3024K piperd 0:00 0.00% /bin/sh /usr/local/libexec/sshg-fw-pf 87613 root 68 0 13M 2328K ttyin 0:00 0.00% /usr/libexec/getty Pc ttyv2 87758 root 68 0 13M 2336K ttyin 0:00 0.00% /usr/libexec/getty Pc ttyv3 50423 root 20 0 19M 5272K piperd 0:00 0.00% /usr/local/libexec/sshg-parser 87420 root 68 0 13M 2336K ttyin 0:00 0.00% /usr/libexec/getty Pc ttyv1 87988 root 68 0 13M 2328K ttyin 0:00 0.00% /usr/libexec/getty Pc ttyv4 88468 root 68 0 13M 2328K ttyin 0:00 0.00% /usr/libexec/getty Pc ttyv6 88778 root 68 0 13M 2328K ttyin 0:00 0.00% /usr/libexec/getty Pc ttyv7 43640 root 28 0 28M 8544K kqread 0:00 0.00% nginx: worker process (nginx) 50079 root 20 0 12M 2344K piperd 0:00 0.00% /bin/cat 88170 root 68 0 13M 2332K ttyin 0:00 0.00% /usr/libexec/getty Pc ttyv5 43367 root 31 0 28M 7972K pause 0:00 0.00% nginx: master process /usr/local/sbin/nginx -c /var/etc/nginx-webConfigurator.conf (nginx) 32039 root 68 0 13M 2868K uwait 0:00 0.00% /usr/local/bin/dpinger -S -r 0 -i ISP_v6 -B 2a10:9200:1:26f:: -p /var/run/dpinger_ISP_v6~2a10:9200:1:26f::~2606:4700:4700::1112.pid -u /var/run/dpinger_ISP_v6~2a10:9200:1:26f::~2606:4700:4700::1112.sock -C /etc/rc.gateway_alarm -d 1 -s 500 -l 2000 -t 60000 -A 1000 -D 500 -L 20 2606:4700:4700::1112{dpinger} 31663 root 68 0 13M 2864K uwait 0:00 0.00% /usr/local/bin/dpinger -S -r 0 -i ISP_v4 -B 77.232.39.159 -p /var/run/dpinger_ISP_v4~77.232.39.159~1.1.1.2.pid -u /var/run/dpinger_ISP_v4~77.232.39.159~1.1.1.2.sock -C /etc/rc.gateway_alarm -d 1 -s 500 -l 2000 -t 60000 -A 1000 -D 500 -L 20 1.1.1.2{dpinger} 77380 root 20 0 12M 2232K nanslp 0:00 0.00% minicron: helper /usr/local/sbin/fcgicli -f /etc/rc.expireaccounts (minicron) 12 root -64 - 0B 304K WAIT 0:00 0.00% [intr{irq11: uhci0}] 16680 root 68 20 12M 2140K nanslp 0:00 0.00% sleep 60 0 root -16 - 0B 1120K - 0:00 0.00% [kernel{z_wr_iss_h_3}] 39251 root 58 0 14M 4124K usem 0:00 0.00% /usr/local/sbin/filterdns -p /var/run/filterdns.pid -i 300 -c /var/etc/filterdns.conf -d 1{merge-thread} 12 root -60 - 0B 304K WAIT 0:00 0.00% [intr{swi6: task queue}] 13152 root 68 0 13M 2280K piperd 0:00 0.00% daemon: /usr/local/libexec/ipsec/charon[13405] (daemon) 12 root -64 - 0B 304K WAIT 0:00 0.00% [intr{irq26: virtio_pci0}] 12260 root 32 0 13M 3288K usem 0:00 0.00% /usr/local/sbin/filterdns -p /var/run/filterdns-ipsec.pid -i 60 -c /var/etc/ipsec/filterdns-ipsec.hosts -d 1{merge-thread} 0 root -16 - 0B 1120K - 0:00 0.00% [kernel{z_wr_int_h_3}] 75311 root 68 0 12M 2212K wait 0:00 0.00% /usr/local/bin/minicron 240 /var/run/ping_hosts.pid /usr/local/bin/ping_hosts.sh 76064 root 68 0 12M 2212K wait 0:00 0.00% /usr/local/bin/minicron 300 /var/run/ipsec_keepalive.pid /usr/local/bin/ipsec_keepalive.php 392 root 68 20 13M 2736K kqread 0:00 0.00% check_reload_status: Monitoring daemon of check_reload_status (check_reload_status) 0 root -16 - 0B 1120K - 0:00 0.00% [kernel{z_wr_int_h_2}] 77988 root 68 0 12M 2216K wait 0:00 0.00% /usr/local/bin/minicron 86400 /var/run/update_alias_url_data.pid /usr/local/sbin/fcgicli -f /etc/rc.update_alias_url_data 39251 root 68 0 14M 4124K usem 0:00 0.00% /usr/local/sbin/filterdns -p /var/run/filterdns.pid -i 300 -c /var/etc/filterdns.conf -d 1{filterdns} 76954 root 68 0 12M 2208K wait 0:00 0.00% /usr/local/bin/minicron 3600 /var/run/expire_accounts.pid /usr/local/sbin/fcgicli -f /etc/rc.expireaccounts 12260 root 60 0 13M 3288K usem 0:00 0.00% /usr/local/sbin/filterdns -p /var/run/filterdns-ipsec.pid -i 60 -c /var/etc/ipsec/filterdns-ipsec.hosts -d 1{filterdns} 78318 root 68 0 12M 2240K nanslp 0:00 0.00% minicron: helper /usr/local/sbin/fcgicli -f /etc/rc.update_alias_url_data (minicron) 16 root -60 - 0B 80K - 0:00 0.00% [usb{usbus0}] 6 root -8 - 0B 624K zevent 0:00 0.00% [zfskern{sysevent}] 4 root -16 - 0B 48K - 0:00 0.00% [cam{doneq0}] 0 root -16 - 0B 1120K - 0:00 0.00% [kernel{z_rd_iss_7}] 6 root -8 - 0B 624K - 0:00 0.00% [zfskern{zfsvfs}] 50667 root 24 0 13M 3020K wait 0:00 0.00% /bin/sh /usr/local/sbin/sshguard -i /var/run/sshguard.pid 0 root -16 - 0B 1120K - 0:00 0.00% [kernel{z_rd_iss_6}] 0 root -16 - 0B 1120K - 0:00 0.00% [kernel{z_rd_iss_5}] 39251 root 68 0 14M 4124K usem 0:00 0.00% /usr/local/sbin/filterdns -p /var/run/filterdns.pid -i 300 -c /var/etc/filterdns.conf -d 1{filterdns} 14 root -8 - 0B 48K - 0:00 0.00% [geom{g_down}] 39251 root 68 0 14M 4124K usem 0:00 0.00% /usr/local/sbin/filterdns -p /var/run/filterdns.pid -i 300 -c /var/etc/filterdns.conf -d 1{filterdns} 4 root -16 - 0B 48K - 0:00 0.00% [cam{async}] 0 root -16 - 0B 1120K - 0:00 0.00% [kernel{z_wr_iss_h_4}] 6 root -8 - 0B 624K - 0:00 0.00% [zfskern{z_upgrade}] 0 root 8 - 0B 1120K - 0:00 0.00% [kernel{linuxkpi_irq_wq}] 12 root -64 - 0B 304K WAIT 0:00 0.00% [intr{irq1: atkbd0}] 0 root -16 - 0B 1120K - 0:00 0.00% [kernel{z_rd_iss_4}] 0 root -16 - 0B 1120K vtbslp 0:00 0.00% [kernel{virtio_balloon}] 6 root -8 - 0B 624K - 0:00 0.00% [zfskern{z_vdev_file_6}] 13 root -16 - 0B 16K sleep 0:00 0.00% [ng_queue] 14 root -8 - 0B 48K - 0:00 0.00% [geom{g_up}] 0 root -16 - 0B 1120K - 0:00 0.00% [kernel{z_rd_iss_0}] 0 root -8 - 0B 1120K - 0:00 0.00% [kernel{CAM taskq}] 0 root -60 - 0B 1120K - 0:00 0.00% [kernel{if_io_tqg_0}] 0 root -64 - 0B 1120K - 0:00 0.00% [kernel{vtnet0 rxq 0}] 10 root -16 - 0B 16K audit_ 0:00 0.00% [audit] 0 root 8 - 0B 1120K - 0:00 0.00% [kernel{inm_free taskq}] 6 root -8 - 0B 624K - 0:00 0.00% [zfskern{z_vdev_file_9}] 6 root -8 - 0B 624K - 0:00 0.00% [zfskern{z_vdev_file_4}] 6 root -8 - 0B 624K - 0:00 0.00% [zfskern{z_vdev_file_12}] 0 root -16 - 0B 1120K - 0:00 0.00% [kernel{z_wr_iss_h_0}] 0 root -16 - 0B 1120K - 0:00 0.00% [kernel{z_rd_iss_2}] 3 root -16 - 0B 32K crypto 0:00 0.00% [crypto{crypto}] 0 root 8 - 0B 1120K - 0:00 0.00% [kernel{linuxkpi_long_wq_0}] 0 root -8 - 0B 1120K - 0:00 0.00% [kernel{system_delay_taskq}] 6 root -8 - 0B 624K t->zth 0:00 0.00% [zfskern{z_checkpoint_discar}] 6 root -8 - 0B 624K t->zth 0:00 0.00% [zfskern{arc_evict}] 6 root -8 - 0B 624K - 0:00 0.00% [zfskern{z_vdev_file_14}] 0 root -16 - 0B 1120K - 0:00 0.00% [kernel{z_rd_iss_1}] 0 root -20 - 0B 1120K - 0:00 0.00% [kernel{crypto}] 0 root 8 - 0B 1120K - 0:00 0.00% [kernel{firmware taskq}] 0 root 8 - 0B 1120K - 0:00 0.00% [kernel{pci_hp taskq}] 0 root 8 - 0B 1120K - 0:00 0.00% [kernel{linuxkpi_short_wq_1}] 6 root -8 - 0B 624K - 0:00 0.00% [zfskern{z_vdev_file_3}] 6 root -8 - 0B 624K - 0:00 0.00% [zfskern{z_vdev_file_8}] 0 root -16 - 0B 1120K - 0:00 0.00% [kernel{z_cl_iss}] 0 root -16 - 0B 1120K - 0:00 0.00% [kernel{z_trim_int}] 15 root -16 - 0B 16K seqsta 0:00 0.00% [sequencer 00] 16 root -60 - 0B 80K - 0:00 0.00% [usb{usbus0}] 5 root -60 - 0B 16K - 0:00 0.00% [busdma] 0 root -64 - 0B 1120K - 0:00 0.00% [kernel{vtnet0 txq 0}] 0 root -64 - 0B 1120K - 0:00 0.00% [kernel{ip_mroute_tskq task}] 0 root 8 - 0B 1120K - 0:00 0.00% [kernel{deferred_unmount ta}] 6 root -8 - 0B 624K t->zth 0:00 0.00% [zfskern{z_livelist_condense}] 6 root -8 - 0B 624K - 0:00 0.00% [zfskern{z_vdev_file_11}] 6 root -8 - 0B 624K - 0:00 0.00% [zfskern{z_zrele}] 0 root -16 - 0B 1120K - 0:00 0.00% [kernel{z_trim_iss_1}] 0 root -16 - 0B 1120K - 0:00 0.00% [kernel{z_ioctl_iss}] 6 root -16 - 0B 624K - 0:00 0.00% [zfskern{metaslab_group_task}] 21 root -16 - 0B 16K aldslp 0:00 0.00% [ALQ Daemon] 17 root -16 - 0B 16K psleep 0:00 0.00% [vmdaemon] 16 root -60 - 0B 80K - 0:00 0.00% [usb{usbus0}] 0 root 8 - 0B 1120K - 0:00 0.00% [kernel{kqueue_ctx taskq}] 0 root 8 - 0B 1120K - 0:00 0.00% [kernel{linuxkpi_short_wq_3}] 0 root 8 - 0B 1120K - 0:00 0.00% [kernel{linuxkpi_long_wq_3}] 0 root 8 - 0B 1120K - 0:00 0.00% [kernel{linuxkpi_long_wq_2}] 0 root 8 - 0B 1120K - 0:00 0.00% [kernel{acpi_task_0}] 0 root 8 - 0B 1120K - 0:00 0.00% [kernel{aiod_kick taskq}] 0 root 8 - 0B 1120K - 0:00 0.00% [kernel{acpi_task_1}] 0 root 8 - 0B 1120K - 0:00 0.00% [kernel{linuxkpi_short_wq_0}] 6 root -8 - 0B 624K - 0:00 0.00% [zfskern{z_vdev_file_1}] 6 root -8 - 0B 624K - 0:00 0.00% [zfskern{z_vdev_file_0}] 6 root -8 - 0B 624K - 0:00 0.00% [zfskern{z_prefetch}] 6 root -8 - 0B 624K - 0:00 0.00% [zfskern{z_unlinked_drain}] 0 root -16 - 0B 1120K - 0:00 0.00% [kernel{z_fr_int}] 0 root -16 - 0B 1120K - 0:00 0.00% [kernel{z_trim_iss_3}] 0 root -16 - 0B 1120K - 0:00 0.00% [kernel{z_wr_int_h_1}] 0 root -60 - 0B 1120K - 0:00 0.00% [kernel{if_config_tqg_0}] 0 root -60 - 0B 1120K - 0:00 0.00% [kernel{t4_rst_thr}] 16 root -60 - 0B 80K - 0:00 0.00% [usb{usbus0}] 9 root -16 - 0B 48K launds 0:00 0.00% [pagedaemon{laundry: dom0}] 0 root 8 - 0B 1120K - 0:00 0.00% [kernel{in6m_free taskq}] 0 root -8 - 0B 1120K - 0:00 0.00% [kernel{arc_prune}] 6 root -8 - 0B 624K - 0:00 0.00% [zfskern{z_vdev_file_7}] 0 root -16 - 0B 1120K - 0:00 0.00% [kernel{z_rd_iss_3}] 3 root -16 - 0B 32K crypto 0:00 0.00% [crypto{crypto returns 0}] 0 root 8 - 0B 1120K - 0:00 0.00% [kernel{mlx4}] 0 root 8 - 0B 1120K - 0:00 0.00% [kernel{linuxkpi_short_wq_2}] 0 root 8 - 0B 1120K - 0:00 0.00% [kernel{linuxkpi_long_wq_1}] 6 root -8 - 0B 624K - 0:00 0.00% [zfskern{z_vdev_file_10}] 6 root -8 - 0B 624K t->zth 0:00 0.00% [zfskern{z_livelist_destroy}] 6 root -8 - 0B 624K - 0:00 0.00% [zfskern{z_vdev_file_2}] 6 root -8 - 0B 624K - 0:00 0.00% [zfskern{z_vdev_file_13}] 6 root -8 - 0B 624K - 0:00 0.00% [zfskern{z_vdev_file_15}] 6 root -8 - 0B 624K - 0:00 0.00% [zfskern{z_zvol}] 6 root -8 - 0B 624K - 0:00 0.00% [zfskern{z_vdev_file_5}] 6 root -8 - 0B 624K t->zth 0:00 0.00% [zfskern{z_indirect_condense}] 0 root -16 - 0B 1120K - 0:00 0.00% [kernel{z_wr_int_h_0}] 0 root -16 - 0B 1120K - 0:00 0.00% [kernel{z_trim_iss_2}] 0 root -16 - 0B 1120K - 0:00 0.00% [kernel{z_cl_int}] 0 root -16 - 0B 1120K - 0:00 0.00% [kernel{z_fr_iss}] 0 root 8 - 0B 1120K - 0:00 0.00% [kernel{acpi_task_2}] 0 root -16 - 0B 1120K - 0:00 0.00% [kernel{z_wr_iss_h_1}] 0 root -16 - 0B 1120K - 0:00 0.00% [kernel{z_trim_iss_0}] 12 root -60 - 0B 304K WAIT 0:00 0.00% [intr{swi5: fast taskq}] 12 root -60 - 0B 304K WAIT 0:00 0.00% [intr{swi1: pf send}] 12 root -60 - 0B 304K WAIT 0:00 0.00% [intr{swi1: pfsync}] 12 root -60 - 0B 304K WAIT 0:00 0.00% [intr{swi0: uart}] 12 root -60 - 0B 304K WAIT 0:00 0.00% [intr{swi6: Giant taskq}] 12 root -64 - 0B 304K WAIT 0:00 0.00% [intr{irq24: virtio_pci0}] 12 root -64 - 0B 304K WAIT 0:00 0.00% [intr{irq12: psm0}] 12 root -64 - 0B 304K WAIT 0:00 0.00% [intr{irq10: virtio_pci2}] 12 root -64 - 0B 304K WAIT 0:00 0.00% [intr{irq27: virtio_pci1}] 12 root -64 - 0B 304K WAIT 0:00 0.00% [intr{irq9: acpi0 intsmb0}] 12 root -64 - 0B 304K WAIT 0:00 0.00% [intr{irq15: ata1}] 12 root -64 - 0B 304K WAIT 0:00 0.00% [intr{irq14: ata0}] Netgate pfSense Plus is developed and maintained by Netgate. © ESF 2004 - 2023 View license.

That's the open bug referenced above: https://redmine.pfsense.org/issues/11898

@andyrh Yeah. Thought I had a plan with full backups and easy restore. When it finally updated but no internet (even though the WAN interface was working and responding inside my heart sank. Confirmed when I reloaded the config from backup and was in the same spot. Something with the latest package didn't like something from the old config at all. Didn't have time to troubleshoot so factory reset to 23.01 and quick/dirty setup got it going again. There's always a way back. Someways are easy, and some are unnecessarily complicated.

@bmeeks yes, your are right. Didn't notice it's still stuck at v2.9.20

https://redmine.pfsense.org/issues/14004

@cmcdonald said in Strange kernel messages (zfs) after upgrading to 23.01: fixed in snapshots Don't know what exactly it means, but sounds like it will be fixed with the feature updates. As far is not critical and looks like a debug message, I'll not worry about :) Thanks.

There are workarounds to allow it but the config becomes increasingly complex! Like add the primary as a gateway on the secondary and use that as a failover group.

@steveits said in Unplug WAN before device flash?: In that state no OS is running, so no routing Perfect, this was what I was after. Thank you

@viragomann Thanks this completely resolved my issue.

@bearhntr I had the same issue and evenrually gave in and did a clean install. As a benefit, I got boot environments setup on my SG-4860, which given how long I have had it, did not have it configured. Make sure you have online (autoconfig backup if Plus) and locally downloaded as well before you take the plunge to do a clean install.

The php library error was almost certainly caused by it pulling in a bunch of pkgs from a newer version. On a much older version like that you would need to ensure the update branch is set to match it in order to remain there. By default it will be set to 'Current Stable' version. Steve

@stephenw10 Sorry my miss, I've tested on my iphone with speedtest app near the accesspoint on wifi6 as just a quick random test. The problem was with my iphone, god knows why the speed halved, a restart of the phone was helped. Back to around 850Mbps. PfSense was flawless.

@stephenw10 When we installed the patch, the symptoms were completely gone So thanks a lot for pointing us in the right direction! So case solved Additional info: We think we know why this happens only on those two firewalls. It happens that they are the ones with the most rules and aliases (by far) in our environment. we couldn't pinpoint it at first, because the 15min reload interval kept the load on maximum, so we couldn't see the interval (=the underlying mechanism) at all. But we could trigger the behavior in a "calm phase" by editing and applying a random rule (and thus triggering the reload). Then the load would be up for several minutes.

please don´t forget performing a proper "chmod" after downloading files from outside. FreeBSD chmod

@manjotsc Great! I'm just going to reference this other thread on the same topic, same solution.

@keyser Seeing that FreeBSD 14 is now at the core of pfSense in 23.01, and Wireguards ChaCha20-Poly1305 cipher has been made available for both IPsec and OpenVPN DCO, where are we in terms of hardware acceleration of this stream cipher? It rumours here and there but not really something that will be available soon for usage. Is it supported at all at this point? The new Intel Atom C5000 or P5000 SoC series will be sorted with QAT 2 or QAT 3 as I am informed. If so in which cases - AES-NI, QAT on Intel? SafeXcel on > arm? The DPDK has something right now "available", that is using the Intel QAT to support the ChaCha-Poly algorithm as I know it is the only available source about at this time. This patchset adds Chacha20-Poly1305 implementation to Intel QuickAssist Technology pmd. I know ChaCha20 is much faster (soft) on the CPU than traditional AES block ciphers, but still, Intel released benchmarks on linux that showed wireguard could see anything from 3 to 10X speed increase using AVX512 and QAT. Linux is not FreeBSD, and FreeBSD is the underlying OS for pfSense. They are both "unixoide" OS but nothing more. I would really like to switch to Wireguard for my Site 2 Site tunnels, but since I have SG-2100’s in the other end, The ARM architecture is different from the x86_64 and comes also with an own crypto unit, its strong and powerful but not the same as Intel QAT.

@00sjsl said in After upgrading to 23.01 Status/Monitoring Thermal Sensors not updating: I'm curious as to why corbuc_0 (which seemed to convey real information) is gone, but thermal_tz0 which is always 26.9 C remains. Sorry, I don't know the why, just the what.

@tiekoetter After upgrading to 23.01 I noticed some issues: The most of us all, more or less. I find out the best methods told around here and over the internet was the following; Fresh install 2.7 and upgrade to the 23.01 and then over CLI upgrade to the latest version 23.01 RC From 2.6 (zfs) to 2.7 and then to 23.01 and once more to 23.01 RC as now would be the best two ways to walk. Upgrade > reboot > update the packets and reboot again let went away many of the most problems of my box.

@stephenw10 Yep, going to look in to a noctua cpu fan.