Any reason a hard drive would thrash almost continually after a new install?
-
I am new to pfSense and installed it yesterday on a mini-pc (like one of these https://www.amazon.com/QOTOM-Q330G4-Barebone-Computer-Fanless-firewall/dp/B06ZYG5ZQX). The installation went fine and everything seems to work, but the hard drive I am using seems to constantly thrash. It came out of a laptop computer but the S.M.A.R.T. testing indicates no problems with it so I don't understand why it sounds like it is constantly reading or writing to the drive. Is this normal? And if not, is there any way to find out what's causing it, or to stop the constant noises? I'm just afraid all the thrashing may cause the drive to fail prematurely. It happens whether or not I am connected via ssh or using the web GUI. It even happens when there is absolutely nothing connected to the LAN port!
pfSense version:
2.4.0-RELEASE (amd64)
built on Tue Oct 10 06:43:01 CDT 2017
FreeBSD 11.1-RELEASE-p1 -
Does the harddrive runs steady, with no spin downs and ups ?
A classic harddrive , especially the older ones, draws more power then a SSD with no moving parts.
So if the provided powersupply has no reserve, then the hdd will not run steady and will fail very soon.
Other possibility is a faulthy powercable between the box and hdd.Grtz
DeLorean -
Yes, the drive runs steady.
I did find out that by going to System/Advanced/Miscellaneous and then down to the RAM Disk Settings, if I check the box to Use RAM Disks and set all the Periodic RAM Disk Data Backups to 24, it seems to significantly reduce the drive activity. My suspicion is that pfSense is constantly logging stuff and if you don't use a RAM disk it logs all that stuff directly to the hard drive, so there is more or less a constant stream of data going to the hard drive. If I enable the RAM Disks then there is still occasional activity but not the constant thrashing like I've been hearing.
pfSense must murder SSD's if users don't enable RAM Disks, with that amount of writing going on!
-
It is probably logging unless you have packages installed. I usually enable RAM drives also if I'm forced to use a noisy HD.
The actual total writes is not high. Any recent SSD should go many, many years before getting close to its write limit. However if you're running from something with much more limited write cycles like an SD or CF card moving those to RAM drives will significantly reduce that.
Steve
-
It came out of a laptop computer but the S.M.A.R.T. testing indicates no problems with it so I don't understand why it sounds like it is constantly reading or writing to the drive.
SMART doesn't mean nothing.
It CAN show you if there is some problem, but ''clean'' or ''good'' SMART doesn't mean HDD is OK.It even happens when there is absolutely nothing connected to the LAN port!
If this happens without any packages installed - probably something wrong with HDD itself.
If you cannot afford to replace this drive, run usual ''repair'' procedures (full format, mhdd/Victoria scan/repair) and pray.
Also - try to play with AAM: https://en.wikipedia.org/wiki/Automatic_acoustic_management -
Some drives are loud… I've had a few loud drives that lasted forever and a few quiet ones that died right away. I haven't heard actual drive head knocking in years...
-
If you have SNMP enabled, try disabling it (or at least the hostres module)
To check what is hitting the HDD, use "top -aSH -m io -o total" but be aware when it says 100% that does not mean that 100% of the entire disk write capacity is used, it only means that a process is performing that percentage of the total writes happening at that moment.
-
You can reduce the amount of logged data by going to Status -> System Logs -> Settings and disable logging of the firewall default blocks.
For example I found that Android based devices cause a lot of out of state traffic, and this flooded my log until I disabled the logging of the default blocks.
-
I also find that disabling logging makes logs less trouble to deal with.
-
Thank you to everyone who replied. What follows are a few responses to recent posts:
It is probably logging unless you have packages installed. I usually enable RAM drives also if I'm forced to use a noisy HD.
I would agree with this.
If you cannot afford to replace this drive, run usual ''repair'' procedures (full format, mhdd/Victoria scan/repair) and pray.
Also - try to play with AAM: https://en.wikipedia.org/wiki/Automatic_acoustic_managementThe drive was fully reformatted at the time of the install. I have no idea what you mean by "mhdd/Victoria scan/repair" but I really don't think there is anything wrong with the drive because it was not making the kind of noises a failing drive makes (loud knocks or very repetitive seeking). Rather it sounded like normal drive activity, just quite a bit of it.
Some drives are loud… I've had a few loud drives that lasted forever and a few quiet ones that died right away. I haven't heard actual drive head knocking in years...
I think this is just a semi-loud drive but the other problem is that it is mounted directly to the all-metal case of the system, which I'm sure helps with cooling, but I think does tend to amplify the noise. It's one of those fanless computers where the case is a huge heat sink, and in addition to radiating heat it seems to do a pretty good job of radiating drive noise to a noticeable level. If the drive were in a normal laptop the noise might not even have been noticeable.
If you have SNMP enabled, try disabling it (or at least the hostres module)
To check what is hitting the HDD, use "top -aSH -m io -o total" but be aware when it says 100% that does not mean that 100% of the entire disk write capacity is used, it only means that a process is performing that percentage of the total writes happening at that moment.
Don't have SNMP enabled. I tried the top command you mentioned, but it really didn't show anything that I'd consider useful, but then again I had already moved the logging to RAM.
You can reduce the amount of logged data by going to Status -> System Logs -> Settings and disable logging of the firewall default blocks.
Thanks, I made that change. Even though it's now going to RAM, I don't see the point of excessive logging.
I also find that disabling logging makes logs less trouble to deal with.
I'm not sure if that was supposed to be humorous or serious, but either way you are partly right. It's not that all logging is bad, it's that excessive logging produces a lot of useless output that (in most cases) no one will ever read. I know there are compulsive log readers out there, but even the most dedicated of those folks won't read thousands of lines of logging every day. Logging is really only (sometimes) useful when you are trying to run down a problem, and even then it's only useful if the log entries are meaningful. When the device is operating normally, IMHO there should not be a lot of logging taking place.
What would be nice is if pfSense had "logging profiles" so you could specify the level of logging you want. For example, "minimal", "basic", "everything". Minimal would only log errors and things that are really important, such as something that might indicate the system is under attack, that the software isn't running as it should be, or that hardware is failing. "Basic" would log events that users might want to know about, but not the mundane recurring stuff that is just "normal". "Everything" would be just that, you might set it to this if you were trying to chase down an issue but most people wouldn't want this. Anything that writes to the hard drive every few seconds would be in "Everything". ;) Just a thought.
Thank you again for all the replies.
-
It was meant to be both humorous and serious. I try to make sure that my logs stay at a fixed size and I disable those that a just naggy. Most logs are naggy if you ask me. I do like firewall logs.
