Ver 2.8.0 - PHP Fatal Error - Allowed memory size of 536870912 bytes exhausted

Jungle153

Good evening all,

I have just completed a clean install of pfSense CE 2.8.0.

On the whole it went well, a small issue at the start of the install process as I had to dig around in the advanced settings to allow use of CE repositories.

Once I was past that, all installed well and everything now is setup. However I keep getting the following crash report (approx every few minutes):

Crash report begins. Anonymous machine information:

amd64
15.0-CURRENT
FreeBSD 15.0-CURRENT #1 RELENG_2_8_0-n256081-401ec5f685b9: Wed May 21 23:53:51 UTC 2025 root@freebsd:/var/jenkins/workspace/pfSense-CE-snapshots-2_8_0-main/obj/amd64/0q9vjGjc/var/jenkins/workspace/pfSense-CE-snapshots-2_8_0-main/sources/FreeBSD-src-RE

Crash report details:

PHP Errors:
[01-Jun-2025 17:57:53 Etc/Greenwich] PHP Fatal error: Allowed memory size of 536870912 bytes exhausted (tried to allocate 4096 bytes) in /usr/local/bin/kea2unbound on line 272
[01-Jun-2025 18:02:52 Etc/Greenwich] PHP Fatal error: Allowed memory size of 536870912 bytes exhausted (tried to allocate 4096 bytes) in /usr/local/bin/kea2unbound on line 272
[01-Jun-2025 18:04:53 Etc/Greenwich] PHP Fatal error: Allowed memory size of 536870912 bytes exhausted (tried to allocate 4096 bytes) in /usr/local/bin/kea2unbound on line 272
[01-Jun-2025 18:07:52 Etc/Greenwich] PHP Fatal error: Allowed memory size of 536870912 bytes exhausted (tried to allocate 4096 bytes) in /usr/local/bin/kea2unbound on line 272
[01-Jun-2025 18:10:07 Etc/Greenwich] PHP Fatal error: Allowed memory size of 536870912 bytes exhausted (tried to allocate 4096 bytes) in /usr/local/bin/kea2unbound on line 272

No FreeBSD crash data found.

I have tried increasing the PHP allocated memory in the advanced settings pages, this has not worked.

I am on a steep learning curve, relatively familiar with Linux, less so with FreeBSD.

I am running this on a Protectli Vault FW4C (Intel J3710 processor) with 8Gb of RAM.

Any help in resolving the crash would be gratefully received.

Cheers

gerdesj

@Jungle153 said in Ver 2.8.0 - PHP Fatal Error - Allowed memory size of 536870912 bytes exhausted:

On the whole it went well, a small issue at the start of the install process as I had to dig around in the advanced settings to allow use of CE repositories.

That doesn't sound right. Nowadays you have to go through the absolute naws of "buying" pfSense CE so you can download the installer for it. The installer does not need repos setting up - it knows where they are.

How, exactly are you trying to install pfSense?

SteveITS

@gerdesj actually, … https://docs.netgate.com/pfsense/en/latest/install/install-walkthrough.html#advanced-options

@Jungle153 do you have a lot of leases or something? That seems absurdly high…

Jungle153

@SteveITS

Not many leases. The network is setup with 5 subnets, 1 on each on 3 of the available NICs and 2 of which are VLANS on one of those NICs.

I have IPv6 set up on the network.

Running Tailscale to allow remote access to my services. Also running pfBlocker (using devel version).

I have installed wireguard and system patches packages. Not set up a VPN yet.

This mirrors the setup I had on version 2.7.2 which ran well, other than the odd crash when I tinkered with certain settings on the assignments.

Installed 2.8 as a clean install on a new ssd, used default options in installer once the process started.

Switched the DHCP to kea once install complete, as it had defaulted to ISC. All the config has been done via the GUI, other than activating the LAN on one of the NICs as I forgot to setup during install (I was on my 5th or 6th attempt by then trouble shooting the repo problem)

Hope this all makes sense. Thank you for your help.

Edit: sorry just realised this is a post install problem by rights. Mods please move to correct forum channel.

aster1x6467

@Jungle153 I am having the same problem. It occurred after upgrading to version 2.8.0 from 2.7.2, after having uninstalled all packages. When the upgrade was complete, I switched to Kea DHCP, enabled the new if_pppoe driver, and reinstalled all packages previously used. Among them are tailscale and pfblockerng-devel, same as you mentioned.

However, I do not have IPv6 enabled, and there are only 4 static leases configured in the DHCP server, no other leases currently present. I suspect that this isn't due to the number of leases...

Here is my crash report:

Crash report begins.  Anonymous machine information:

amd64
15.0-CURRENT
FreeBSD 15.0-CURRENT #1 RELENG_2_8_0-n256081-401ec5f685b9: Wed May 21 23:53:51 UTC 2025     root@freebsd:/var/jenkins/workspace/pfSense-CE-snapshots-2_8_0-main/obj/amd64/0q9vjGjc/var/jenkins/workspace/pfSense-CE-snapshots-2_8_0-main/sources/FreeBSD-src-RE

Crash report details:

PHP Errors:
[01-Jun-2025 23:07:56 Europe/Athens] PHP Fatal error:  Allowed memory size of 536870912 bytes exhausted (tried to allocate 4096 bytes) in /usr/local/bin/kea2unbound on line 524
[02-Jun-2025 00:07:56 Europe/Athens] PHP Fatal error:  Allowed memory size of 536870912 bytes exhausted (tried to allocate 4096 bytes) in /usr/local/bin/kea2unbound on line 524
[02-Jun-2025 01:08:02 Europe/Athens] PHP Fatal error:  Allowed memory size of 536870912 bytes exhausted (tried to allocate 4096 bytes) in /usr/local/bin/kea2unbound on line 524
[02-Jun-2025 02:07:56 Europe/Athens] PHP Fatal error:  Allowed memory size of 536870912 bytes exhausted (tried to allocate 4096 bytes) in /usr/local/bin/kea2unbound on line 524
[02-Jun-2025 03:07:56 Europe/Athens] PHP Fatal error:  Allowed memory size of 536870912 bytes exhausted (tried to allocate 4096 bytes) in /usr/local/bin/kea2unbound on line 524
[02-Jun-2025 04:07:55 Europe/Athens] PHP Fatal error:  Allowed memory size of 536870912 bytes exhausted (tried to allocate 4096 bytes) in /usr/local/bin/kea2unbound on line 524
[02-Jun-2025 05:07:55 Europe/Athens] PHP Fatal error:  Allowed memory size of 536870912 bytes exhausted (tried to allocate 4096 bytes) in /usr/local/bin/kea2unbound on line 524
[02-Jun-2025 06:07:55 Europe/Athens] PHP Fatal error:  Allowed memory size of 536870912 bytes exhausted (tried to allocate 4096 bytes) in /usr/local/bin/kea2unbound on line 524
[02-Jun-2025 07:07:54 Europe/Athens] PHP Fatal error:  Allowed memory size of 536870912 bytes exhausted (tried to allocate 4096 bytes) in /usr/local/bin/kea2unbound on line 524
[02-Jun-2025 08:07:59 Europe/Athens] PHP Fatal error:  Allowed memory size of 536870912 bytes exhausted (tried to allocate 4096 bytes) in /usr/local/bin/kea2unbound on line 524
[02-Jun-2025 09:07:55 Europe/Athens] PHP Fatal error:  Allowed memory size of 536870912 bytes exhausted (tried to allocate 4096 bytes) in /usr/local/bin/kea2unbound on line 524
[02-Jun-2025 10:07:55 Europe/Athens] PHP Fatal error:  Allowed memory size of 536870912 bytes exhausted (tried to allocate 4096 bytes) in /usr/local/bin/kea2unbound on line 524
[02-Jun-2025 11:07:54 Europe/Athens] PHP Fatal error:  Allowed memory size of 536870912 bytes exhausted (tried to allocate 4096 bytes) in /usr/local/bin/kea2unbound on line 524



No FreeBSD crash data found.

I also found this possibly related issue in the forum.

Any help would be greatly appreciated.

stephenw10

@Jungle153 said in Ver 2.8.0 - PHP Fatal Error - Allowed memory size of 536870912 bytes exhausted:

Also running pfBlocker

If you're running pfBlocker with a lot of lists then try setting it to use Python mode to avoid hitting the PHP memory limit.

Jungle153

@stephenw10

Thanks for moving the thread. Apologies for putting it in the wrong channel.

Also thank you for your suggestion, I have double checked pfBlocker and it was already in Unbound mode. However uninstalling pfBlocker stops the crash.

Reinstalled the stable version of pfBlocker and the crash returns. At least now I can narrow it down to a pfBlocker issue.

I don't run many lists. I'll cut some down and see if that helps. I do use a couple of IP lists in addition to DNSBL lists. I'll start by removing those first as they don't use unbound as far as I can see.

Cheers

aster1x6467

I think I've found a fix for it. After reading this (the same one I mentioned before), I enabled unbound python mode on pfblocker > DNSBL, and I also enabled python mode on the DNS resolver (unbound). This makes the python module script option show up, where after a DNSBL update, I can select pfb_unbound. This took care of the problem for me, or at least I haven't seen a new crash report in the few hours since I did this.

I'm not sure if python mode is needed on both the DNS resolver and pfblocker, or if enabling just one of the two does the job, if someone tests that I would love to know. I'm also not sure about other side effects from enabling the python modules, but at least it fixes the problem with Kea DHCP and pfblocker not playing nicely.

Jungle153

@aster1x6467

Thank you for the comments.

Since I have disabled IP4 and IP6 block lists the crash seems to have resolved. I have left DNSBL in unbound mode.

I'll give it a day to see if anything crops up, if all works well I'll reactivate IP4 block lists to see if it's just a IP6 issue.

I'll have a look at reporting a bug to the developers, I assume they'll have a GitHub page for it.

Thanks again everyone for your help.

SteveITS

@Jungle153 said in Ver 2.8.0 - PHP Fatal Error - Allowed memory size of 536870912 bytes exhausted:

reporting a bug to the developers, I assume they'll have a GitHub page

https://redmine.pfsense.org/projects/pfsense-packages

or more specifically,
https://redmine.pfsense.org/projects/pfsense-packages/issues?utf8=%E2%9C%93&set_filter=1&sort=id%3Adesc&f%5B%5D=status_id&op%5Bstatus_id%5D=o&f%5B%5D=tracker_id&op%5Btracker_id%5D=%3D&v%5Btracker_id%5D%5B%5D=1&f%5B%5D=category_id&op%5Bcategory_id%5D=%3D&v%5Bcategory_id%5D%5B%5D=97&f%5B%5D=&c%5B%5D=tracker&c%5B%5D=category&c%5B%5D=status&c%5B%5D=priority&c%5B%5D=subject&c%5B%5D=assigned_to&c%5B%5D=updated_on&group_by=&t%5B%5D=

Jungle153

@SteveITS

Thank you for that.

@aster1x6467 My changes didn't work. Reduced the frequency of the crashes. Followed your lead and changed the pfBlocker mode to Python and all resolved by the look of it. I've left Unbound in it's default mode and looking at the various logs everything is working as expected.

stephenw10

Gah! I mistakenly wrote 'Unbound mode'.

Yes, use Python mode for DNS-BL to prevent hitting the PHP limit.

Jungle153

@stephenw10

No worries. It's all fixed now and new problem solving skills learned.

@aster1x6467 @gerdesj @SteveITS
I'd happily upvote all you comments, but apparently my reputation is too low.

so to everyone:

aster1x6467

@Jungle153 Good to hear it worked for you too. Interesting to hear that python mode on the DNS resolver was not needed.

As a follow-up to @stephenw10, do you know if enabling the python mode in the DNS resolver together with the DNSBL python mode has any benefits or other implications (since the DNSBL python mode needs to be enabled to avoid this error either way)? Or are these two completely unrelated?

stephenw10

You need to have the python module enabled in Unbound in order to use Python mode in DNS-BL. I'm not aware of anything else that uses it.

gerdesj

@aster1x6467 You do need to use the python module in Unbound (called the Resolver in pfSense) when using pfBlocker.

There are loads of docs on this by BB17 (I think that is their Nic) but why not start with https://docs.netgate.com/pfsense/en/latest/packages/pfblocker.html

aster1x6467

@stephenw10 @gerdesj Thank you both for the information. I am now looking at posts from BBCan177 and there are indeed plenty. As for the link to the official documentation of the pfblocker package, I'm afraid that it isn't of much help, the information there is somewhat limited.

Thanks to all for the conversation, this was very useful!