Help problam with pfsense work slow
-
768 mega
But it worked until now Excellent
The same amount of memory
What has changed?
snort is installed less than a month
Everything worked properly for about 3 weeks, maybe a little more
Until two days ago -
You shouldn't be running snort on that. Its just not up to it with ram and probably processor either.
-
It does not make sense
It worked fine until I reboot the system
Could it be a problem in one of the components of the computer ?
-
Possible… But not likely.
If you go to diagnostics > command prompt and type this in, what do you get?
sysctl hw.physmem
-
Yep, I would guess Snort used all your RAM and the machine started swapping continuously. Possibly it downloaded a new rule set. If you tune Snort sufficiently it can run in low memory systems but you have to be careful. Can you add more RAM?
Steve
-
Possible… But not likely.
If you go to diagnostics > command prompt and type this in, what do you get?
sysctl hw.physmem
$ sysctl hw.physmem
hw.physmem: 774799360Yep, I would guess Snort used all your RAM and the machine started swapping continuously. Possibly it downloaded a new rule set. If you tune Snort sufficiently it can run in low memory systems but you have to be careful. Can you add more RAM?
Steve
The board has three Memory slots
And all of them are occupiedI'll try to find memories with larger bulk
-
Basically, I asked you to check that so I could see if some of your ram had failed, but its all there.
99 times out of 100 bad ram or bad ram slot will just cause panics and reboots and BSODs. But I've had one time before where a stick just went bye-bye and the thing kept working perfectly just showing less ram.
So, like he said - either trim the memory usage or ditch the memory hogs. Swapping is BAD.
-
Thanks for the answers
I will try to get a larger volume memoriesJust out of curiosity
How much memory is needed for the system to work well with these packagesAnother question
I turned off the snort
The swap usage dropped to 2 percent
And Memory usage dropped between 50 and 70 percentI think like that stephenw10 said here is related to an update of the snort rules
How can I configure the snort not use a lot of memory
Or at least work like two days agoThanks again to everyone
-
Have a look though the forum for running Snort on an Alix board. It's not really recommended, because the Alix has only 256MB and no swap at all, but people have done it. If they can, you can.
At the very least set the performance to 'lowmem' and try to minimise the rule sets you're using.
Steve
-
I did what you said
There are several modes to use memory
For me it was set to AC-STD
I changed it to LOWMEMSo far, so good
Thanks