Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    More on Abnormally High CPU Usage

    Scheduled Pinned Locked Moved General pfSense Questions
    38 Posts 5 Posters 4.0k Views 5 Watching
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • S Offline
      SteveITS Rebel Alliance @Courierdog
      last edited by

      @courierdog
      in "file to be edited" enter /usr/local/pkg/pfblockerng/pfblockerng.inc
      click Load
      next to "go to line #" enter 4139 and press that "go to line #" button
      change the line as noted above
      click Save

      I believe at that point you should Diagnostics/Reboot to ensure the change has been loaded. Not sure that's required but it won't hurt.

      https://docs.netgate.com/pfsense/en/latest/diagnostics/edit-file.html

      Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
      When upgrading, allow 10-15 minutes to reboot, or more depending on packages, and device or disk speed.
      Upvote ๐Ÿ‘ helpful posts!

      CourierdogC 2 Replies Last reply Reply Quote 0
      • CourierdogC Offline
        Courierdog @SteveITS
        last edited by

        @steveits
        Steve
        I followed your instructions however line 4139 does not have anything close to the previous code
        as noted bt NOCling https://redmine.pfsense.org/issues/13154

        File: /usr/local/pkg/pfblockerng/pfblockerng.inc
        Line: 4139
        From:
        $r = explode(')', $result, 2);
        To:
        $r = explode(' ', $result, 2);

        $r = explode(')', $result, 2);

        this coding is Not found plus or minus 50 lines in my version (22.05)

        Perhaps if you gave me the code line 10 line before and 10 line after the desired code I may be able to scan and locate the desired code of r = explode

        Or the Code sequence that this small change is part of.

        I will not just drop the suggested code anywhere as the instructions are very specific:
        FROM - $r = explode(')', $result, 2);
        TO - $r = explode(' ', $result, 2);

        S 1 Reply Last reply Reply Quote 0
        • N Offline
          NOCling
          last edited by

          My 2100:
          5ab7d838-a4f0-48e8-a7e5-373da7a05a94-image.png

          Its there.

          22.05-RELEASE (arm64)
          pfBlockerNG-devel 3.1.0_4

          Netgate 6100 & Netgate 2100

          CourierdogC 1 Reply Last reply Reply Quote 0
          • S Offline
            SteveITS Rebel Alliance @Courierdog
            last edited by

            @courierdog What version of pfBlockerNG-devel do you have? 3.1.0_4 is the latest.

            $rule_list		= array();
            $rule_list['id']	= array();
            $rule_list['other']	= array();
            $rule_list['int']	= array();
            
            exec("{$pfb['pfctl']} -vvsr 2>&1", $results);
            if (!empty($results)) {
            	foreach ($results as $result) {
            		if (substr($result, 0, 1) == '@') {
            
            			$r = explode(')', $result, 2);
            
            			// pfSense > v2.6 uses an 'ridentifier' string
            			if (strpos($result, 'ridentifier') != FALSE) {
            				$id = trim(strstr(strstr($r[1], 'ridentifier', FALSE), ' ', FALSE));
            			} else {
            				$id = ltrim(strstr($r[0], '(', FALSE), '(');
            			}
            
            			// Find rule descriptions and type for pfBlockerNG Tracker IDs
            			if (strpos($r[1], ' <pfB_') !== FALSE) {
            				$descr	= ltrim(stristr($r[1], '<pfb_', FALSE), '<');
            				$descr	= strstr($descr, ':', TRUE);
            				$type	= strstr(trim($r[1]), ' ', TRUE);
            				if ($type == 'match') {
            					$type = 'unkn(%u)';
            				}
            

            Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
            When upgrading, allow 10-15 minutes to reboot, or more depending on packages, and device or disk speed.
            Upvote ๐Ÿ‘ helpful posts!

            CourierdogC 2 Replies Last reply Reply Quote 0
            • CourierdogC Offline
              Courierdog @SteveITS
              last edited by

              @steveits
              pfBlockerNG-devel net 3.1.0_4

              And I am not finding the coding you are listing.

              This is beginning to scare the life out of me.
              pfsense was recommend to be as a solution to all the crap I have been going through.
              It certainly has removed 99.9% of the issues.
              I noticed that I was getting notifications from MaxMind stating I required a license.
              In another blog it suggested an update to the pfBlocker which I did, and it worked for about 30 minutes and then I noticed the increased CPU Usage.
              Which has alarmed me, as I do not want to be running the CPU at excessive usage and possible risk overheating the device.
              It was that the other day when I logged in I noticed the CPU usage had gone totally mad as it has bee typically less than ten with the occasional burst to 40% for a second.

              1 Reply Last reply Reply Quote 0
              • CourierdogC Offline
                Courierdog @SteveITS
                last edited by

                @steveits
                I now notice the following notifications at the bottom of the page
                = Update = Current

                = Remove = Information = Reinstall

                Newer version available

                Package is configured but not (fully) installed or deprecated.

                I have been working my way through the book SAFER @ Home by Michael Lines.
                This is where he suggested I use PfBlocker as a means to block the obvious CyberAttack avenues.
                So my setup ha only gone as far as he outlines in his book.

                S stephenw10S 2 Replies Last reply Reply Quote 0
                • S Offline
                  SteveITS Rebel Alliance @Courierdog
                  last edited by SteveITS

                  @courierdog The package page can be a bit confusing at first. The bottom is just a legend, but it doesn't say it's a legend. On this one the system patches package has an upgrade available, the others do not:
                  666b4cae-a099-461b-bf4b-35150787993d-image.png

                  re: file, you have the right file? Did you CTRL+F it? Once I typo'd the "4139" and got myself confused.

                  Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
                  When upgrading, allow 10-15 minutes to reboot, or more depending on packages, and device or disk speed.
                  Upvote ๐Ÿ‘ helpful posts!

                  1 Reply Last reply Reply Quote 1
                  • stephenw10S Offline
                    stephenw10 Netgate Administrator @Courierdog
                    last edited by

                    @courierdog said in More on Abnormally High CPU Usage:

                    I now notice the following notifications at the bottom of the page
                    = Update = Current
                    = Remove = Information = Reinstall
                    Newer version available
                    Package is configured but not (fully) installed or deprecated.

                    That's just the key to the list of installed packages.

                    I assume you are seeing the file existing?

                    CourierdogC S 2 Replies Last reply Reply Quote 0
                    • CourierdogC Offline
                      Courierdog @stephenw10
                      last edited by

                      @steveits
                      once I enter and load the file I receive the following:
                      <?php
                      /*

                      • pfblockerng.inc
                      • part of pfSense (https://www.pfsense.org)
                      • Copyright (c) 2015-2022 Rubicon Communications, LLC (Netgate)
                      • Copyright (c) 2015-2022 BBcan177@gmail.com
                      • All rights reserved.

                      This tells me I have loaded the pfblockerng
                      code
                      I enter the Line Number 4139 and press ENTER
                      I arrive at the following:
                      // Create update file indicator for update process
                      touch("{$pfb['dbdir']}/{$filename}/{$filename}.update");
                      } else {
                      pfb_logger('.', 1);
                      exec("/usr/bin/gunzip -c {$file_dwn}.raw > {$file_dwn}.orig", $output, $retval);
                      }
                      }
                      elseif ($file_type == 'application/x-bzip2') {
                      pfb_logger('.', 1);
                      exec("/usr/bin/bzip2 -dkc {$file_dwn}.raw > {$file_dwn}.orig", $output, $retval);
                      }
                      elseif ($file_type == 'application/zip') {

                      		// Extras - MaxMind/TOP1M downloads
                      		if ($type == 'geoip' || $type == 'top1m') {
                      			// Determine if Zip contains multiple files
                      			exec("/usr/bin/tar -tf {$file_dwn}.raw 2>&1", $archive_count, $retval);
                      			if ($archive_count[0] == 'tar: Failed to set default locale') {
                      				unset($archive_count[0]);
                      
                      1 Reply Last reply Reply Quote 0
                      • S Offline
                        SteveITS Rebel Alliance @stephenw10
                        last edited by

                        You could always remove and reinstall the package. By default it keeps its settings.

                        CTRL+F should find "$r = explode(')', $result, 2);" only once. It's several scrolls/pages below the code you posted.

                        Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
                        When upgrading, allow 10-15 minutes to reboot, or more depending on packages, and device or disk speed.
                        Upvote ๐Ÿ‘ helpful posts!

                        CourierdogC 1 Reply Last reply Reply Quote 0
                        • CourierdogC Offline
                          Courierdog @SteveITS
                          last edited by

                          @steveits
                          Steve, I was just going to say the code you listed is several pages below where I came up at 4139 on my computer.
                          I use a MacBook Pro
                          And I stand corrected when I enter the page #4139 I hit enter (return)
                          I will now go to the file as you described and wait for further instructions.

                          1 Reply Last reply Reply Quote 0
                          • CourierdogC Offline
                            Courierdog @NOCling
                            last edited by

                            @nocling
                            OK
                            I finally did find the files as you and Steve posted.
                            They are several pages below where I landed after entering 4139 and pressing enter.

                            The FROM and TO that has been suggested.
                            If I do this from the GUI
                            FROM $r = explode(')', $result, 2);
                            TO. $r = explode(' ', $result, 2);

                            Is this a matter of typing over the existing code as displayed and pressing SAVE

                            Or is there something else I must do.

                            I have never edited the pfsense code directly only configured the install set up from the GUI

                            S 1 Reply Last reply Reply Quote 0
                            • S Offline
                              SteveITS Rebel Alliance @Courierdog
                              last edited by

                              @courierdog said in More on Abnormally High CPU Usage:

                              Is this a matter of typing over the existing code as displayed and pressing SAVE

                              Yes.

                              If it breaks, edit the file back again, or just uninstall/reinstall the package to get the original file. (you could, say, copy/paste the entire field into a file on your PC)

                              Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
                              When upgrading, allow 10-15 minutes to reboot, or more depending on packages, and device or disk speed.
                              Upvote ๐Ÿ‘ helpful posts!

                              CourierdogC 1 Reply Last reply Reply Quote 0
                              • CourierdogC Offline
                                Courierdog @SteveITS
                                last edited by

                                @steveits
                                Steve:
                                Thanks, I entered the code over the existing code, pressed save.
                                Received the notification the file was saved successfully.

                                Diagnostics -> Reboot

                                Login.

                                For the first few minutes the CPU Usage was 20-40%
                                Now it is back at 99-100%
                                I will recheck the code to verify if it was changed.

                                The current code

                                if (substr($result, 0, 1) == '@') {

                                			$r = explode('', $result, 2);
                                
                                			// pfSense > v2.6 uses an 'ridentifier' string
                                

                                This is as I was instructed except I expected a space between the ' ',

                                So any more suggestions?

                                S 1 Reply Last reply Reply Quote 0
                                • S Offline
                                  SteveITS Rebel Alliance @Courierdog
                                  last edited by

                                  @courierdog said in More on Abnormally High CPU Usage:

                                  $r = explode('', $result, 2);

                                  It should be a space:

                                  $r = explode(' ', $result, 2);

                                  Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
                                  When upgrading, allow 10-15 minutes to reboot, or more depending on packages, and device or disk speed.
                                  Upvote ๐Ÿ‘ helpful posts!

                                  CourierdogC 1 Reply Last reply Reply Quote 0
                                  • CourierdogC Offline
                                    Courierdog @SteveITS
                                    last edited by

                                    @steveits
                                    The edited text code had one space between the two '

                                    %(#000000)[Since it was still running CPU usage of 99-100% I decided to add a second space.]

                                    Result after 15 minutes of operation
                                    CPU Usage = 14-40%

                                    While not back to the 5-26% where was running before I began to get notification of a required License for MaxMind.

                                    S 1 Reply Last reply Reply Quote 0
                                    • S Offline
                                      SteveITS Rebel Alliance @Courierdog
                                      last edited by

                                      @courierdog OK, it had no space above. It needs one, or it wonโ€™t process the data correctly. The CPU may fluctuate as it processes. A 2100 doesnโ€™t have a super powerful CPU but does fine for what it is. The dashboard uses CPU as it updates. My 2100 is hovering around 15-25% on the dashboard while watching a streaming show.

                                      Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
                                      When upgrading, allow 10-15 minutes to reboot, or more depending on packages, and device or disk speed.
                                      Upvote ๐Ÿ‘ helpful posts!

                                      CourierdogC 1 Reply Last reply Reply Quote 0
                                      • CourierdogC Offline
                                        Courierdog @SteveITS
                                        last edited by

                                        @steveits
                                        Steve: the SG-2100, is a huge improvement over the SG-1100 I started with.
                                        I got the one with the maximum amount of RAM.
                                        My opinion is Netgate should have a slightly more open platform, allow, 3rd party storage and 3rd party RAM.
                                        One other option which I would like to see is a plug in WiFi board.
                                        I like the Netgate pfsense box because it draws so little power, and it is a stand alone firewall.
                                        My other option is a small footprint box suitable for Linux but they draw too much current for the dedicated task.
                                        I have run virtually every commercial home network router on the market.
                                        I have had cyber attacks and a hyjack of my WiFi System.
                                        Since the install of the pfsense firewall, ZERO successful intrusions or hyjacking of my WiFi.
                                        So far I am quite happy with the Netgate SG-2100 pfsense Firewall.
                                        Thanks for your patience and willingness to help a newbie.
                                        While I had worked for a Telco for 22 years, I worked on the RF side of the house.
                                        Any internet networking is all new to me even at 81 I still do all my own work on the Home all Apple Network c/w 2 NAS storage units.

                                        S 1 Reply Last reply Reply Quote 1
                                        • S Offline
                                          SteveITS Rebel Alliance @Courierdog
                                          last edited by

                                          @courierdog said in More on Abnormally High CPU Usage:

                                          Netgate should have a slightly more open platform, allow, 3rd party storage and 3rd party RAM.

                                          I get your point but especially with the smaller devices I would expect parts are fastened to the board and there aren't slots. Third party parts are tricky, if it causes a problem and the owner wants tech support why should that be on Netgate? Etc.

                                          One other option which I would like to see is a plug in WiFi board.

                                          If you watch this forum a while you'll see people post that FreeBSD wireless drivers are not great. (ref: Netgate support time above) So while theoretically convenient, it's usually better to use an external AP.

                                          Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
                                          When upgrading, allow 10-15 minutes to reboot, or more depending on packages, and device or disk speed.
                                          Upvote ๐Ÿ‘ helpful posts!

                                          1 Reply Last reply Reply Quote 0
                                          • stephenw10S Offline
                                            stephenw10 Netgate Administrator
                                            last edited by

                                            Yes with ARM based devices adding additional RAM becomes an issue. And for small appliances it all starts to add to the cost.

                                            You can actually fit a wifi card to the 2100 but the only one I'm aware of that works is the WLE200NX which is a 2x2 802.11n device. So it's hard to recommend that.
                                            There is ongoing work in FreeBSD to bring in far better wifi support but an external AP is always going to be better IMO.

                                            Steve

                                            CourierdogC 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.