running out of swap space

[f5alcon]

Today I started running out of swap space after about 5 minutes from boot. At which point new devices can't connect and I can't use ssh or web gui unless i reboot.

Those are the only packages installed now. I uninstalled suricata and PFblockerNG

It seems like it is /usr/lib/sys/rcu_bj but I am not sure what that is.

[f5alcon]

@f5alcon

[SteveITS]

@f5alcon I see these in a quick search:

https://www.reddit.com/r/PFSENSE/comments/10osmp6/anyone_know_anything_about_rcu_udev_rcu_libk_or/

https://forum.netgate.com/topic/177466/usr-lib-sys-rcu_bj-usr-lib-sys-rcu_udev

[f5alcon]

@steveits Thanks, I removed all of the files in the /usr/lib/sys directory and now it seems fine. Probably will do a full reinstall and drive format and restore my config from xml just to be sure.

[stephenw10]

Yes, you should reinstall clean and make sure you don't have the gui open to the internet.

[f5alcon]

@stephenw10 How do i check for the gui being exposed to the internet? I created a WAN firewall rule to block https traffic to the IP of the system. changed the port and turned off ssh access and moved from a 12 character to 30+ character password.

I reinstalled and upgraded from 2.6 to pfsense+ 23.01 as well and reconfigured pfblocker.

[SteveITS]

@f5alcon said in running out of swap space:

How do i check for the gui being exposed to the internet?

Check the WAN rules (another recent poster had a block rule but it was using a Source of WAN Address, so was completely open). [edit: because they had also added an allow all rule ]

Check the GUI Service log at https://xxxx/status_logs.php?logfile=nginx for public IP addresses.

[stephenw10]

By default all traffic inbound is blocked on the WAN anyway so this only applies if you've added a rule to pass traffic.