Help problam with pfsense work slow

stephenw10

If the machine starts using swap for regular stuff (rather than only when updating Snort for example) then you need more RAM. Swap is slow. How much RAM do you have?

Steve

firefox

768 mega

But it worked until now Excellent

The same amount of memory

What has changed?

snort is installed less than a month
Everything worked properly for about 3 weeks, maybe a little more
Until two days ago

kejianshi

You shouldn't be running snort on that. Its just not up to it with ram and probably processor either.

firefox

It does not make sense

It worked fine until I reboot the system

Could it be a problem in one of the components of the computer ?

kejianshi

Possible… But not likely.

If you go to diagnostics > command prompt and type this in, what do you get?

sysctl hw.physmem

stephenw10

Yep, I would guess Snort used all your RAM and the machine started swapping continuously. Possibly it downloaded a new rule set. If you tune Snort sufficiently it can run in low memory systems but you have to be careful. Can you add more RAM?

Steve

firefox

@kejianshi:

Possible… But not likely.

If you go to diagnostics > command prompt and type this in, what do you get?

sysctl hw.physmem

$ sysctl hw.physmem
hw.physmem: 774799360

@stephenw10:

Yep, I would guess Snort used all your RAM and the machine started swapping continuously. Possibly it downloaded a new rule set. If you tune Snort sufficiently it can run in low memory systems but you have to be careful. Can you add more RAM?

Steve

The board has three Memory slots
And all of them are occupied

I'll try to find memories with larger bulk

kejianshi

Basically, I asked you to check that so I could see if some of your ram had failed, but its all there.

99 times out of 100 bad ram or bad ram slot will just cause panics and reboots and BSODs. But I've had one time before where a stick just went bye-bye and the thing kept working perfectly just showing less ram.

So, like he said - either trim the memory usage or ditch the memory hogs. Swapping is BAD.

firefox

Thanks for the answers
I will try to get a larger volume memories

Just out of curiosity
How much memory is needed for the system to work well with these packages

Another question
I turned off the snort
The swap usage dropped to 2 percent
And Memory usage dropped between 50 and 70 percent

I think like that stephenw10 said here is related to an update of the snort rules

How can I configure the snort not use a lot of memory
Or at least work like two days ago

Thanks again to everyone

stephenw10

Have a look though the forum for running Snort on an Alix board. It's not really recommended, because the Alix has only 256MB and no swap at all, but people have done it. If they can, you can.

At the very least set the performance to 'lowmem' and try to minimise the rule sets you're using.

Steve

firefox

I did what you said
There are several modes to use memory
For me it was set to AC-STD
I changed it to LOWMEM

So far, so good

Thanks