Unofficial E2guardian package for pfSense

pfsensation · Aug 3, 2017, 8:39 PM

@pfsensation:

That issue caused my pfsense box to restart (after nearly a week) … Don't you get this issue Marcelloc?

I'm really busy these days on my main job. I'll test it since I have some time.

Don't you think it's better to restart the process every two days to avoid these memory's problems until a new binary version?

Yes I do, but it may also be a log rotation issue. In some cases restarting the process doesn't give the allocated RAM back (from e2g). Clearing the logs seem to help quite significantly. Maybe you should try adding a access.log rotation every 24 hours until the issue is fixed?

It seems this is not even a BSD issue, as people on Ubuntu are also noticing high RAM usage.

Regarding work… I'm on the same boat. But this is annoying, whenever I am home I need to keep checking my pfSense, I absolutely hate logging in and seeing that it crashed...:/

empbilly · Aug 12, 2017, 4:46 PM

I am also using the e2guardian and in a matter of hours the "memory ram" and swap are skyrocketing. I modified the script that marcelloc suggested in some posts above and when it restarts the service, for example 90% and 75% respectively, the values fall to 50% for memory and normalize the swap.

pfsensation · Aug 12, 2017, 4:55 PM

@empbilly:

I am also using the e2guardian and in a matter of hours the "memory ram" and swap are skyrocketing. I modified the script that marcelloc suggested in some posts above and when it restarts the service, for example 90% and 75% respectively, the values fall to 50% for memory and normalize the swap.

Can you share your script? This is driving me insane now…

empbilly · Aug 12, 2017, 6:46 PM

Script by remzej
Original: https://forum.pfsense.org/index.php?topic=126309.msg727239#msg727239

Modified:

#!/usr/local/bin/php-cgi -q
/*
 * monitor_memory_usage.php
 *
 * part of pfSense (https://www.pfsense.org)
 * Copyright (c) 2011-2015 Rubicon Communications, LLC (Netgate)
 * All rights reserved.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 * http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
require_once('config.inc');
require_once('util.inc');
require_once('squid.inc');
require_once('e2guardian.inc');
global $config;

	// Monitor memory usage by remzej
	// Get SWAP usage funtion
	function swap_usage() {
		exec("/usr/sbin/swapinfo", $swap_info);
		$swap_used = "";
		foreach ($swap_info as $line) {
			if (preg_match('/(\d+)%$/', $line, $matches)) {
				$swap_used = $matches[1];
				break;
			}
		}
		return $swap_used;
	}

	// Get memory usage function
	function mem_usage() {
		$memory = "";
		exec("/sbin/sysctl -n vm.stats.vm.v_page_count vm.stats.vm.v_inactive_count " .
			"vm.stats.vm.v_cache_count vm.stats.vm.v_free_count", $memory);

		$totalMem = $memory[0];
		$availMem = $memory[1] + $memory[2] + $memory[3];
		$usedMem = $totalMem - $availMem;
		$memUsage = round(($usedMem * 100) / $totalMem, 0);

		return $memUsage;
	}

	// Get memory and SWAP usage value
	$memusage_pct = mem_usage();
	$swapusage_pct = swap_usage();

	// Display memory usage
	echo "Memory Usage: " . $memusage_pct . "%" . PHP_EOL;
	echo "SWAP Usage: " . $swapusage_pct . "%" . PHP_EOL;

	// If memory usage is above 90% and SWAP usage is above 75%, stop and restart squid services.  
	if ((($memusage_pct > 70) && ($swapusage_pct > 50)) || ($memusage_pct > 55) ) {
		// stop e2g service
		exec("/usr/local/sbin/e2guardian stop");
		// stop squid service
		squid_stop_monitor();
		if (is_service_running('squid')) {
			stop_service("squid");
		}
                // start e2g service
		exec("/usr/local/sbin/e2guardian start");
		// start squid service
                squid_restart_services();
		log_error(gettext(sprintf("[squid] Memory usage is $memusage_pct percent and SWAP usage is $swapusage_pct percent, stopping and restarting services.")));
	}
?>

pfsensation · Aug 12, 2017, 9:40 PM

@empbilly:

Script by remzej
Original: https://forum.pfsense.org/index.php?topic=126309.msg727239#msg727239

Modified:

#!/usr/local/bin/php-cgi -q
/*
 * monitor_memory_usage.php
 *
 * part of pfSense (https://www.pfsense.org)
 * Copyright (c) 2011-2015 Rubicon Communications, LLC (Netgate)
 * All rights reserved.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 * http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
require_once('config.inc');
require_once('util.inc');
require_once('squid.inc');
require_once('e2guardian.inc');
global $config;

	// Monitor memory usage by remzej
	// Get SWAP usage funtion
	function swap_usage() {
		exec("/usr/sbin/swapinfo", $swap_info);
		$swap_used = "";
		foreach ($swap_info as $line) {
			if (preg_match('/(\d+)%$/', $line, $matches)) {
				$swap_used = $matches[1];
				break;
			}
		}
		return $swap_used;
	}

	// Get memory usage function
	function mem_usage() {
		$memory = "";
		exec("/sbin/sysctl -n vm.stats.vm.v_page_count vm.stats.vm.v_inactive_count " .
			"vm.stats.vm.v_cache_count vm.stats.vm.v_free_count", $memory);

		$totalMem = $memory[0];
		$availMem = $memory[1] + $memory[2] + $memory[3];
		$usedMem = $totalMem - $availMem;
		$memUsage = round(($usedMem * 100) / $totalMem, 0);

		return $memUsage;
	}
	
	// Get memory and SWAP usage value
	$memusage_pct = mem_usage();
	$swapusage_pct = swap_usage();

	// Display memory usage
	echo "Memory Usage: " . $memusage_pct . "%" . PHP_EOL;
	echo "SWAP Usage: " . $swapusage_pct . "%" . PHP_EOL;

	// If memory usage is above 90% and SWAP usage is above 75%, stop and restart squid services.  
	if ((($memusage_pct > 70) && ($swapusage_pct > 50)) || ($memusage_pct > 55) ) {
		// stop e2g service
		exec("/usr/local/sbin/e2guardian stop");
		// stop squid service
		squid_stop_monitor();
		if (is_service_running('squid')) {
			stop_service("squid");
		}
                // start e2g service
		exec("/usr/local/sbin/e2guardian start");
		// start squid service
                squid_restart_services();
		log_error(gettext(sprintf("[squid] Memory usage is $memusage_pct percent and SWAP usage is $swapusage_pct percent, stopping and restarting services.")));
	}
?>

Thanks! I see you left the code for Squid there too, is there really a need to kill off squid too? From what I've seen, restarting E2 Guardian works just fine.

empbilly · Aug 12, 2017, 10:14 PM

@pfsensation:

@empbilly:

Script by remzej
Original: https://forum.pfsense.org/index.php?topic=126309.msg727239#msg727239

Modified:

#!/usr/local/bin/php-cgi -q
/*
 * monitor_memory_usage.php
 *
 * part of pfSense (https://www.pfsense.org)
 * Copyright (c) 2011-2015 Rubicon Communications, LLC (Netgate)
 * All rights reserved.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 * http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
require_once('config.inc');
require_once('util.inc');
require_once('squid.inc');
require_once('e2guardian.inc');
global $config;

	// Monitor memory usage by remzej
	// Get SWAP usage funtion
	function swap_usage() {
		exec("/usr/sbin/swapinfo", $swap_info);
		$swap_used = "";
		foreach ($swap_info as $line) {
			if (preg_match('/(\d+)%$/', $line, $matches)) {
				$swap_used = $matches[1];
				break;
			}
		}
		return $swap_used;
	}

	// Get memory usage function
	function mem_usage() {
		$memory = "";
		exec("/sbin/sysctl -n vm.stats.vm.v_page_count vm.stats.vm.v_inactive_count " .
			"vm.stats.vm.v_cache_count vm.stats.vm.v_free_count", $memory);

		$totalMem = $memory[0];
		$availMem = $memory[1] + $memory[2] + $memory[3];
		$usedMem = $totalMem - $availMem;
		$memUsage = round(($usedMem * 100) / $totalMem, 0);

		return $memUsage;
	}
	
	// Get memory and SWAP usage value
	$memusage_pct = mem_usage();
	$swapusage_pct = swap_usage();

	// Display memory usage
	echo "Memory Usage: " . $memusage_pct . "%" . PHP_EOL;
	echo "SWAP Usage: " . $swapusage_pct . "%" . PHP_EOL;

	// If memory usage is above 90% and SWAP usage is above 75%, stop and restart squid services.  
	if ((($memusage_pct > 70) && ($swapusage_pct > 50)) || ($memusage_pct > 55) ) {
		// stop e2g service
		exec("/usr/local/sbin/e2guardian stop");
		// stop squid service
		squid_stop_monitor();
		if (is_service_running('squid')) {
			stop_service("squid");
		}
                // start e2g service
		exec("/usr/local/sbin/e2guardian start");
		// start squid service
                squid_restart_services();
		log_error(gettext(sprintf("[squid] Memory usage is $memusage_pct percent and SWAP usage is $swapusage_pct percent, stopping and restarting services.")));
	}
?>

Thanks! I see you left the code for Squid there too, is there really a need to kill off squid too? From what I've seen, restarting E2 Guardian works just fine.

So, I ended up just adding the e2g block. :D

pfsensation · Aug 13, 2017, 5:09 PM

I'm starting to experience system dumps again. Anyone else experiencing the same? Very strange… I've already clean installed.

marcelloc · Aug 14, 2017, 9:15 PM

@pfsensation:

I'm starting to experience system dumps again. Anyone else experiencing the same? Very strange… I've already clean installed.

I've compiled the binaries again with the little changes from previous 4.1.2_2 we were using to 4.1.3. I don't expect any change on process behavior from last update but I've compiled it anyway to keep this project with the latest updates from e2guardian.

pfsensation · Aug 19, 2017, 12:00 PM

@marcelloc:

@pfsensation:

I'm starting to experience system dumps again. Anyone else experiencing the same? Very strange… I've already clean installed.

I've compiled the binaries again with the little changes from previous 4.1.2_2 we were using to 4.1.3. I don't expect any change on process behavior from last update but I've compiled it anyway to keep this project with the latest updates from e2guardian.

https://pastebin.com/zdMs98Zy It's now crashing often again… Only thing that changed is I think at one point there was a unexpected loss of power to the machine. Could this be it?

pfsensation · Aug 20, 2017, 6:38 PM

Marcello can you take a look at the dump? Also how can I fully clean all files left over by E2Guardian? It's really annoying, I don't want to keep reinstalling pfSense…That sucks.

marcelloc · Aug 30, 2017, 4:23 PM

@pfsensation:

Also how can I fully clean all files left over by E2Guardian?

Uninstall the package will remove xml files and bsd package. /usr/local/etc/e2guardian will keep some files and e2guardian options will stay on xml.

marcelloc · Aug 30, 2017, 4:25 PM

Great news!

v5-testing has the ssl filtering

bedmakaveli · Sep 6, 2017, 8:43 AM

Hello guys,
here I am again :) .
After setting all up, and get E2guardian working correctly, I would love to redirect to the courtesy page also for https pages.
I've read a lot of posts without finding something clear.
I'm using explicit proxy setting, so i don't need the MITSSL, or at least I think so.
There is a way to redirect the https pages to the courtesy page visualized on blocked http traffic or should i lose my hopes?

Thanks marcelloc for all the work, I'll repay the efforts with a lot of coffes :)

PS: sorry for the repost, maybe here is the correct place for this kind of question :)

marcelloc · Sep 6, 2017, 10:10 AM

Take a look on report options. You can redirect to a external url or chance current template.

bedmakaveli · Sep 7, 2017, 10:08 AM

@marcelloc:

Take a look on report options. You can redirect to a external url or chance current template.

Thanks marcelloc for the reply.
But how can I redirect to the report page when I try to access to an https site?
It seems to work only for http sites.

marcelloc · Sep 7, 2017, 2:06 PM

@bedmakaveli:

@marcelloc:

Take a look on report options. You can redirect to a external url or chance current template.

Thanks marcelloc for the reply.
But how can I redirect to the report page when I try to access to an https site?
It seems to work only for http sites.

Intercepting SSL. You can setup it on group settings but you need to install certificate authority on clients.

bedmakaveli · Sep 17, 2017, 5:05 PM

@marcelloc:

@bedmakaveli:

@marcelloc:

Take a look on report options. You can redirect to a external url or chance current template.

Thanks marcelloc for the reply.
But how can I redirect to the report page when I try to access to an https site?
It seems to work only for http sites.

Intercepting SSL. You can setup it on group settings but you need to install certificate authority on clients.

Thanks Marcello, it works like a charm now. I've tried with a self signed CA.

Thanks again!

pfsensation · Oct 27, 2017, 8:14 PM

Hi Marcello,

I'm still getting crashes, can you please investigate this as there's no where else that will provide support for this setup… I'm currently on pfsense 2.4 with the latest version of E2 Guardian.

modinadar · Nov 16, 2017, 10:24 AM

Hello dear users of this forum. I have a question about this package. As much as I'm not trying to set up "Phrase Lists", it allways skips to sites with these words. Perhaps this is due to the fact that I use phrases from my language (Russian, I have not tried English words). I set up the mitm, it blocks everything well, "serach engines" works also only on English words, but it's not surprising. Simply Russian characters are encoded in some% as% dc% 5g … and so on. The only way for me to block using "Phrase lists", as I read on a Russian-language forum that the predecessor of Dansguardian knew how to do it, but there were difficulties with encodings. In general, it may be necessary to include some parameter in the configuration about which I do not know.
Sorry for my english, I used an interpreter.

pfsensation · Nov 23, 2017, 11:31 PM

Thanks to some brilliant help from the Pfsense community, I think my crashes are finally resolved with some bootloader.conf.local addons.

It'll be nice to see this package kept up to date, especially as V5 is coming out soon!