please help

mohamed8080

My network
Domain controller at windows server 2016
services run on it (dhcp-dns)
making forward to dns from windows server to pfsense

pfsense Services is
c-icap ICAP Inteface for Squid and ClamAV integration
clamd ClamAV Antivirus
dpinger Gateway Monitoring Daemon
lightsquid_web Lightsquid Web Server
ntopng ntopng Network Traffic Monitor
ntpd NTP clock sync
pfb_dnsbl pfBlockerNG DNSBL service
pfb_filter pfBlockerNG firewall filter service
snort Snort IDS/IPS Daemon
squid Squid Proxy Server Service
squidGuard Proxy server filter Service
syslogd System Logger Daemon
unbound DNS Resolver

mohamed8080

@BBcan177 4722819 /var/dhcpd/var/db/dhcpd.leases

Gertjan

@mohamed8080 said in please help:

My network
Domain controller at windows server 2016
services run on it (dhcp-dns)
making forward to dns from windows server to pfsense

DHCP is served by pfSense or the domain controller ?

@mohamed8080 said in please help:

@BBcan177 4722819 /var/dhcpd/var/db/dhcpd.leases

@BBcan177 will say :
Yes, pfBlocker-ng will read in, and parse the current active DHCP lease file.
That file with that size will 'explode' any system - not only yours.
This file can't be that big. For short : it's not a "pfBlocker-ng", the problems is something else.

Let's try to understand why this file "/var/dhcpd/var/db/dhcpd.leases" is that big.

Did you ran your "fsck" checks ?

mohamed8080

@Gertjan said in please help:

fsck

DHCP is served by Domain Controller (windows server 2016) .

i was try that command touch /root/force_fsck on GUI and reboot pfSense

first error view like http page and The second error on Crash Reporter

Fatal error: Allowed memory size of 536870912 bytes exhausted (tried to allocate 134217736 bytes) in /usr/local/www/status_dhcp_leases.php on line 59 PHP ERROR: Type: 1, File: /usr/local/www/status_dhcp_leases.php, Line: 59, Message: Allowed memory size of 536870912 bytes exhausted (tried to allocate 134217736 bytes)

and

PHP Errors:
[09-Jan-2020 10:06:24 Africa/Cairo] PHP Fatal error: Allowed memory size of 536870912 bytes exhausted (tried to allocate 134217736 bytes) in /usr/local/www/status_dhcp_leases.php on line 59
[09-Jan-2020 10:18:53 Africa/Cairo] PHP Fatal error: Allowed memory size of 536870912 bytes exhausted (tried to allocate 268435464 bytes) in /usr/local/pkg/pfblockerng/pfblockerng.inc on line 3367

how can allow memory size to PHP i have 16GB of ram and SSD HDD in pfSense

sorry for bazaring you and thanks for support

Gertjan

This error :
@mohamed8080 said in please help:

[09-Jan-2020 10:06:24 Africa/Cairo] PHP Fatal error: Allowed memory size of 536870912 bytes exhausted (tried to allocate 134217736 bytes) in /usr/local/www/status_dhcp_leases.php on line 59

show clearly that not only pfblockerng has severe difficulties reading the lease file, but also others, like the DHCP status page from pfSense itself.

This file shouldn't even exists, because, if pfSense isn't even serving leases - some other device (your DC does that).

Goto console mode (not the GUI Diagnostics > Command Prompt) and move this file out of the way :

mv /var/dhcpd/var/db/dhcpd.leases /var/dhcpd/var/db/dhcpd.leases.backup
touch /var/dhcpd/var/db/dhcpd.leases

JeGr

normally /var/dhcpd/var/db/dhcpd.leases is simple ASCII textfile so you should be able to read it on the shell/via SSH with a simple

less /var/dhcpd/var/db/dhcpd.leases

Have a look at it and check if it makes sense. If you haven't pfSense configured as your DHCP server on any network segment/VLAN then that file shouldn't be even a few kB big.

Gertjan

@JeGr said in please help:

Have a look at it and check if it makes sense.

Was asking that already several posts above.
Nothing came back ....

I guess he saw the ....

# The format of this file is documented in the dhcpd.leases(5) manual page.
# This lease file was written by isc-dhcp-4.3.6-P1

# authoring-byte-order entry is generated, DO NOT DELETE
authoring-byte-order little-endian;

lease 192.168.2.6 {
  starts 1 2019/12/02 03:50:37;
  ends 1 2019/12/02 09:50:37;
  tstp 1 2019/12/02 09:50:37;
  cltt 1 2019/12/02 03:50:37;
  binding state free;
  hardware ethernet 00:16:7f:25:43:d4;
  uid "\001\000\026\177%C\324";
  set vendor-class-identifier = "android-dhcp-7.1.2";
}
....
....

and thought that was normal. Which is the case.

The fact that he shut down the pfSense DHCP server because he was using another one explains why the file isn't 'maintained' any more - the dhcp daemon isn't running any more (this is to be confirmed) : the file stays in place.
Why the file became this big, under what circumstances, and when, puzzles me.

Like he had running the DHCP server on pfSense and his AD at the same comment ?
Did he use pfBlocker for a long time ?
What is the end of the /var/dhcpd/var/db/dhcpd.leases file ? It's only the DHCP daemon that's maintaining this file - leases are dumped to it.

mohamed8080

@Gertjan said in please help:

touch /var/dhcpd/var/db/dhcpd.leases

thanks the problem is ended with your advice

Gertjan

Good !

So it was a matter of emptying this huge file , which has no meaning because the local DHCP server wasn't running anyway.

Still, I still don't get why this file became this big. I guess we will never know.
Keep an eye on it, though - it should stay at a zero byte file if local pfSense DHCP isn't used. If you decide to use local DHCP, it could become several KB, that's ok.

mohamed8080

@Gertjan i will keep watching
thanks again