Ver 2.8.0 - PHP Fatal Error - Allowed memory size of 536870912 bytes exhausted

Jungle153

Thanks for moving the thread. Apologies for putting it in the wrong channel.

Also thank you for your suggestion, I have double checked pfBlocker and it was already in Unbound mode. However uninstalling pfBlocker stops the crash.

Reinstalled the stable version of pfBlocker and the crash returns. At least now I can narrow it down to a pfBlocker issue.

I don't run many lists. I'll cut some down and see if that helps. I do use a couple of IP lists in addition to DNSBL lists. I'll start by removing those first as they don't use unbound as far as I can see.

Cheers

aster1x6467

I think I've found a fix for it. After reading this (the same one I mentioned before), I enabled unbound python mode on pfblocker > DNSBL, and I also enabled python mode on the DNS resolver (unbound). This makes the python module script option show up, where after a DNSBL update, I can select pfb_unbound. This took care of the problem for me, or at least I haven't seen a new crash report in the few hours since I did this.

I'm not sure if python mode is needed on both the DNS resolver and pfblocker, or if enabling just one of the two does the job, if someone tests that I would love to know. I'm also not sure about other side effects from enabling the python modules, but at least it fixes the problem with Kea DHCP and pfblocker not playing nicely.

Jungle153

@aster1x6467

Thank you for the comments.

Since I have disabled IP4 and IP6 block lists the crash seems to have resolved. I have left DNSBL in unbound mode.

I'll give it a day to see if anything crops up, if all works well I'll reactivate IP4 block lists to see if it's just a IP6 issue.

I'll have a look at reporting a bug to the developers, I assume they'll have a GitHub page for it.

Thanks again everyone for your help.

SteveITS

@Jungle153 said in Ver 2.8.0 - PHP Fatal Error - Allowed memory size of 536870912 bytes exhausted:

reporting a bug to the developers, I assume they'll have a GitHub page

https://redmine.pfsense.org/projects/pfsense-packages

or more specifically,
https://redmine.pfsense.org/projects/pfsense-packages/issues?utf8=%E2%9C%93&set_filter=1&sort=id%3Adesc&f%5B%5D=status_id&op%5Bstatus_id%5D=o&f%5B%5D=tracker_id&op%5Btracker_id%5D=%3D&v%5Btracker_id%5D%5B%5D=1&f%5B%5D=category_id&op%5Bcategory_id%5D=%3D&v%5Bcategory_id%5D%5B%5D=97&f%5B%5D=&c%5B%5D=tracker&c%5B%5D=category&c%5B%5D=status&c%5B%5D=priority&c%5B%5D=subject&c%5B%5D=assigned_to&c%5B%5D=updated_on&group_by=&t%5B%5D=

Jungle153

@SteveITS

Thank you for that.

@aster1x6467 My changes didn't work. Reduced the frequency of the crashes. Followed your lead and changed the pfBlocker mode to Python and all resolved by the look of it. I've left Unbound in it's default mode and looking at the various logs everything is working as expected.

stephenw10

Gah! I mistakenly wrote 'Unbound mode'.

Yes, use Python mode for DNS-BL to prevent hitting the PHP limit.

Jungle153

@stephenw10

No worries. It's all fixed now and new problem solving skills learned.

@aster1x6467 @gerdesj @SteveITS
I'd happily upvote all you comments, but apparently my reputation is too low.

so to everyone:

aster1x6467

@Jungle153 Good to hear it worked for you too. Interesting to hear that python mode on the DNS resolver was not needed.

As a follow-up to @stephenw10, do you know if enabling the python mode in the DNS resolver together with the DNSBL python mode has any benefits or other implications (since the DNSBL python mode needs to be enabled to avoid this error either way)? Or are these two completely unrelated?

stephenw10

You need to have the python module enabled in Unbound in order to use Python mode in DNS-BL. I'm not aware of anything else that uses it.

gerdesj

@aster1x6467 You do need to use the python module in Unbound (called the Resolver in pfSense) when using pfBlocker.

There are loads of docs on this by BB17 (I think that is their Nic) but why not start with https://docs.netgate.com/pfsense/en/latest/packages/pfblocker.html

aster1x6467

@stephenw10 @gerdesj Thank you both for the information. I am now looking at posts from BBCan177 and there are indeed plenty. As for the link to the official documentation of the pfblocker package, I'm afraid that it isn't of much help, the information there is somewhat limited.

Thanks to all for the conversation, this was very useful!