Another Netgate with storage failure, 6 in total so far

dugeem

One additional issue to be aware of is that up until pfSense+ 24.03 the Netgate SG-1100 (& SG-2100) installation images resulted in eMMC having non aligned flash partitions. This can result in file system activity causing sub optimal block writing (due to sectors crossing erase boundaries) resulting in increased flash wear.

pfSense Redmine reference -> https://redmine.pfsense.org/issues/15126

Easy to check - from shell use the command:

gpart show mmcsd0

and check numbers in first column for either freebsd / freebsd-zfs partitions are divisible by 8 (or a higher power of 2).

Generally if your SG-1100 (also SG-2100) was originally commissioned prior to pfSense+ 24.03 then you should consider reinstalling and restoring config.

Relevant Netgate SG-1100 documentation -> https://docs.netgate.com/pfsense/en/latest/solutions/sg-1100/reinstall-pfsense.html

w0w

Netgate has finally implemented the fix.
https://redmine.pfsense.org/issues/16210#change-76840
Thank you, @marcosm, @fireodo, @andrew_cb

Patch

Looks like it changes the vfs.zfs.txg.timeout default from
FreeBSD vfs.zfs.txg.timeout = 5
pfsense vfs.zfs.txg.timeout = 30

So not as high as 120 suggested but consistent with andrew_cb recommendation

mvikman

That patch code also has this: "zfs set sync=always pfSense/ROOT/default/cf"
Looking at my own system, I don't have that path, as I have only manually named Boot Environments, I have paths like "pfSense/ROOT/24.11_stable/cf ", so that part would fail.

Should the command be run manually on the current default/active BE path, "pfSense/ROOT/24.11_stable/cf " in my case?

stephenw10

Yup. Fix incoming.

JonathanLee

@stephenw10 should the timeout be 120 or 30?

JonathanLee

@andrew_cb

zfs set sync=always pfSense/ROOT/default/cf

does not work on my 2100 I have a SSD should I run a different command for this?

marcosm

A fix will be provided once it's ready on the following redmine:
https://redmine.pfsense.org/issues/16212

marcosm

A patch is now available for testing on the redmine.

Mission-Ghost

@stephenw10 is there a way to stop python pfblocker logging? I’ve tried to shut off all logging in pfblocker but the python module keeps on logging.

I’d prefer to keep using the python module for its benefits but the logging I don’t use often consumes my ssd lifetime at all other times without benefit.

SteveITS

@Mission-Ghost What logging are you seeing?

Mission-Ghost

@SteveITS dnsbl.log just keeps going and going:

This is useful on rare occasions when I need to find a site to white-list, but I'd like to turn it on only on such occasions and off the rest of the time.

SteveITS

@Mission-Ghost That's set for all lists here:

or else on each list, e.g. on Firewall/pfBlockerNG/IP/IPv4.

With the logging off we have:

File successfully loaded: Total Lines: 0
Log/File Path: /var/log/pfblockerng/dnsbl.log

Mission-Ghost

@SteveITS Thank you!

I found and set it on the master configuration:

The master setting seems to be working so far.

Why does "Null Block (no logging)" log?

Why does "No Global mode" not log?

Is it just, me, or do the bullet points on the master DNSBL page fail to explain this clearly?

By my way of reading this, "No Global Mode" tells me that the individual settings on each Group will prevail. It doesn't tell me that it is overriding the individual settings on each Group, and sure doesn't tell me that logging is disabled, unlike "no logging" which says it's disabled but it isn't.

I feel like I'm taking crazy pills!

SteveITS

@Mission-Ghost No Global should mean it doesn’t override the individual settings. I just set it when creating each list so if the global settings aren’t working I profess ignorance. :)

Mission-Ghost

@SteveITS said in Another Netgate with storage failure, 6 in total so far:

@Mission-Ghost No Global should mean it doesn’t override the individual settings. I just set it when creating each list so if the global settings aren’t working I profess ignorance. :)

Well, I guess it should mean it, but in context to some of of us who didn't develop the software, it isn't clear, particularly when adjacent options include "no logging" which apparently could not mean 'no' logging.

Seems like getting an English major (>gasp!<) intern to help redefine the labels to be more meaningful to customers would be a low cost, easy improvement to the usability of the product.

In any case, thank you for your generous help clarifying this. My problem is solved.