Unbound stability is worrying

wallaceian · Oct 24, 2020, 10:59 PM

Hello, configuring SG-2100 in test lab before launching for a client - I don't want to run into instability however unbound is worrying - see PIC's below. And YES I have to manually start DNS Resolver from time to time (randomly, but it could be linked to pfblockerNG)

From a system health standpoint does the below look worrying to you ?

login-to-view

Hardware SG-2100
pfsense 2.4.5-RELEASE-p1 (arm64)
pfBlockerNG-devel net 2.2.5_37

Kind Regards
Ian

johnpoz · Oct 24, 2020, 11:59 PM

Where is your swap? And running snort sure isn't going to be helping..

here is my 4860..

last pid: 27568;  load averages:  0.27,  0.23,  0.23  up 137+05:41:13    18:55:38
280 processes: 5 running, 223 sleeping, 8 zombie, 44 waiting

Mem: 135M Active, 473M Inact, 1014M Wired, 617M Buf, 6254M Free
Swap: 1459M Total, 1459M Free

That load is pretty high..

I don't have a 2100, but I would think there should be some swap?

wallaceian · Oct 25, 2020, 5:44 PM

Thank you kind sir for the reply.

What alternative to Snort would you recommend ? In Netgate 2100 storage is 8GB eMMC Flash on board with system Memory 4 GB DDR4. I've not tampered with swap config from factory settings, should I be reviewing a change to get rid of the errors.

login-to-view

johnpoz · Oct 25, 2020, 8:52 PM

@wallaceian said in Unbound stability is worrying:

What alternative to Snort would you recommend ?

Not running it - what are you doing that justifies the need or want of IPS? Most everything is https these days so your going to be seeing what exactly?

Are you serving up services, and doing https offload upstream so your IPS will see everything in the clear to your http servers on the backend?

Just because pfsense can do ips, doesn't mean it makes sense to do so in every scenario..

chrcoluk · Oct 26, 2020, 3:01 PM

You either need more ram, or to add a big enough swap file.

pfblockerng with large lists will of course increase unbound memory requirements.

Impatient · Oct 26, 2020, 4:23 PM

Swap file is going to be slower than ram.
As long as you have 4GB there has to be a choice made for package's.

Even then you will probably have to restrict the rule's and/or list's you have enabled.

chrcoluk · Oct 26, 2020, 8:40 PM

Obviously the proper fix is to deal with the configuration that is over stressing the memory in the system, but as a quick workaround in the mean time just enable swap.

I usually enable swap on all my systems, just to act as a buffer for these types of moments.

heper · Oct 26, 2020, 10:21 PM

@chrcoluk said in Unbound stability is worrying:

Obviously the proper fix is to deal with the configuration that is over stressing the memory in the system, but as a quick workaround in the mean time just enable swap.

I usually enable swap on all my systems, just to act as a buffer for these types of moments.

Not sure if swapping to an 8gb flash drive is the best idea....