Unofficial E2guardian package for pfSense

pfsensation

Hi Marcello,

I reported the issue to E2 Guardian devs : https://github.com/e2guardian/e2guardian/issues/266

Could you please provide your input as you made the package and know exactly what changed since the last update?

Thanks

marcelloc

Hi Marcello,

I reported the issue to E2 Guardian devs : https://github.com/e2guardian/e2guardian/issues/266

Could you please provide your input as you made the package and know exactly what changed since the last update?

Thanks

I'm trying to reproduce de issue first on my boxes. try to include on git issue a screenshot of top showing e2guardian memory usage.

pfsensation

That issue caused my pfsense box to restart (after nearly a week) … Don't you get this issue Marcelloc?

marcelloc

@pfsensation:

That issue caused my pfsense box to restart (after nearly a week) … Don't you get this issue Marcelloc?

I'm really busy these days on my main job. I'll test it since I have some time.

Don't you think it's better to restart the process every two days to avoid these memory's problems until a new binary version?

pfsensation

@marcelloc:

@pfsensation:

That issue caused my pfsense box to restart (after nearly a week) … Don't you get this issue Marcelloc?

I'm really busy these days on my main job. I'll test it since I have some time.

Don't you think it's better to restart the process every two days to avoid these memory's problems until a new binary version?

Yes I do, but it may also be a log rotation issue. In some cases restarting the process doesn't give the allocated RAM back (from e2g). Clearing the logs seem to help quite significantly. Maybe you should try adding a access.log rotation every 24 hours until the issue is fixed?

It seems this is not even a BSD issue, as people on Ubuntu are also noticing high RAM usage.

Regarding work… I'm on the same boat. But this is annoying, whenever I am home I need to keep checking my pfSense, I absolutely hate logging in and seeing that it crashed...:/

empbilly

I am also using the e2guardian and in a matter of hours the "memory ram" and swap are skyrocketing. I modified the script that marcelloc suggested in some posts above and when it restarts the service, for example 90% and 75% respectively, the values fall to 50% for memory and normalize the swap.

pfsensation

@empbilly:

I am also using the e2guardian and in a matter of hours the "memory ram" and swap are skyrocketing. I modified the script that marcelloc suggested in some posts above and when it restarts the service, for example 90% and 75% respectively, the values fall to 50% for memory and normalize the swap.

Can you share your script? This is driving me insane now…

empbilly

Script by remzej
Original: https://forum.pfsense.org/index.php?topic=126309.msg727239#msg727239

Modified:

#!/usr/local/bin/php-cgi -q
/*
 * monitor_memory_usage.php
 *
 * part of pfSense (https://www.pfsense.org)
 * Copyright (c) 2011-2015 Rubicon Communications, LLC (Netgate)
 * All rights reserved.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 * http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
require_once('config.inc');
require_once('util.inc');
require_once('squid.inc');
require_once('e2guardian.inc');
global $config;

	// Monitor memory usage by remzej
	// Get SWAP usage funtion
	function swap_usage() {
		exec("/usr/sbin/swapinfo", $swap_info);
		$swap_used = "";
		foreach ($swap_info as $line) {
			if (preg_match('/(\d+)%$/', $line, $matches)) {
				$swap_used = $matches[1];
				break;
			}
		}
		return $swap_used;
	}

	// Get memory usage function
	function mem_usage() {
		$memory = "";
		exec("/sbin/sysctl -n vm.stats.vm.v_page_count vm.stats.vm.v_inactive_count " .
			"vm.stats.vm.v_cache_count vm.stats.vm.v_free_count", $memory);

		$totalMem = $memory[0];
		$availMem = $memory[1] + $memory[2] + $memory[3];
		$usedMem = $totalMem - $availMem;
		$memUsage = round(($usedMem * 100) / $totalMem, 0);

		return $memUsage;
	}

	// Get memory and SWAP usage value
	$memusage_pct = mem_usage();
	$swapusage_pct = swap_usage();

	// Display memory usage
	echo "Memory Usage: " . $memusage_pct . "%" . PHP_EOL;
	echo "SWAP Usage: " . $swapusage_pct . "%" . PHP_EOL;

	// If memory usage is above 90% and SWAP usage is above 75%, stop and restart squid services.  
	if ((($memusage_pct > 70) && ($swapusage_pct > 50)) || ($memusage_pct > 55) ) {
		// stop e2g service
		exec("/usr/local/sbin/e2guardian stop");
		// stop squid service
		squid_stop_monitor();
		if (is_service_running('squid')) {
			stop_service("squid");
		}
                // start e2g service
		exec("/usr/local/sbin/e2guardian start");
		// start squid service
                squid_restart_services();
		log_error(gettext(sprintf("[squid] Memory usage is $memusage_pct percent and SWAP usage is $swapusage_pct percent, stopping and restarting services.")));
	}
?>

pfsensation

@empbilly:

Script by remzej
Original: https://forum.pfsense.org/index.php?topic=126309.msg727239#msg727239

Modified:

#!/usr/local/bin/php-cgi -q
/*
 * monitor_memory_usage.php
 *
 * part of pfSense (https://www.pfsense.org)
 * Copyright (c) 2011-2015 Rubicon Communications, LLC (Netgate)
 * All rights reserved.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 * http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
require_once('config.inc');
require_once('util.inc');
require_once('squid.inc');
require_once('e2guardian.inc');
global $config;

	// Monitor memory usage by remzej
	// Get SWAP usage funtion
	function swap_usage() {
		exec("/usr/sbin/swapinfo", $swap_info);
		$swap_used = "";
		foreach ($swap_info as $line) {
			if (preg_match('/(\d+)%$/', $line, $matches)) {
				$swap_used = $matches[1];
				break;
			}
		}
		return $swap_used;
	}

	// Get memory usage function
	function mem_usage() {
		$memory = "";
		exec("/sbin/sysctl -n vm.stats.vm.v_page_count vm.stats.vm.v_inactive_count " .
			"vm.stats.vm.v_cache_count vm.stats.vm.v_free_count", $memory);

		$totalMem = $memory[0];
		$availMem = $memory[1] + $memory[2] + $memory[3];
		$usedMem = $totalMem - $availMem;
		$memUsage = round(($usedMem * 100) / $totalMem, 0);

		return $memUsage;
	}
	
	// Get memory and SWAP usage value
	$memusage_pct = mem_usage();
	$swapusage_pct = swap_usage();

	// Display memory usage
	echo "Memory Usage: " . $memusage_pct . "%" . PHP_EOL;
	echo "SWAP Usage: " . $swapusage_pct . "%" . PHP_EOL;

	// If memory usage is above 90% and SWAP usage is above 75%, stop and restart squid services.  
	if ((($memusage_pct > 70) && ($swapusage_pct > 50)) || ($memusage_pct > 55) ) {
		// stop e2g service
		exec("/usr/local/sbin/e2guardian stop");
		// stop squid service
		squid_stop_monitor();
		if (is_service_running('squid')) {
			stop_service("squid");
		}
                // start e2g service
		exec("/usr/local/sbin/e2guardian start");
		// start squid service
                squid_restart_services();
		log_error(gettext(sprintf("[squid] Memory usage is $memusage_pct percent and SWAP usage is $swapusage_pct percent, stopping and restarting services.")));
	}
?>

Thanks! I see you left the code for Squid there too, is there really a need to kill off squid too? From what I've seen, restarting E2 Guardian works just fine.

empbilly

@pfsensation:

@empbilly:

Script by remzej
Original: https://forum.pfsense.org/index.php?topic=126309.msg727239#msg727239

Modified:

#!/usr/local/bin/php-cgi -q
/*
 * monitor_memory_usage.php
 *
 * part of pfSense (https://www.pfsense.org)
 * Copyright (c) 2011-2015 Rubicon Communications, LLC (Netgate)
 * All rights reserved.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 * http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
require_once('config.inc');
require_once('util.inc');
require_once('squid.inc');
require_once('e2guardian.inc');
global $config;

	// Monitor memory usage by remzej
	// Get SWAP usage funtion
	function swap_usage() {
		exec("/usr/sbin/swapinfo", $swap_info);
		$swap_used = "";
		foreach ($swap_info as $line) {
			if (preg_match('/(\d+)%$/', $line, $matches)) {
				$swap_used = $matches[1];
				break;
			}
		}
		return $swap_used;
	}

	// Get memory usage function
	function mem_usage() {
		$memory = "";
		exec("/sbin/sysctl -n vm.stats.vm.v_page_count vm.stats.vm.v_inactive_count " .
			"vm.stats.vm.v_cache_count vm.stats.vm.v_free_count", $memory);

		$totalMem = $memory[0];
		$availMem = $memory[1] + $memory[2] + $memory[3];
		$usedMem = $totalMem - $availMem;
		$memUsage = round(($usedMem * 100) / $totalMem, 0);

		return $memUsage;
	}
	
	// Get memory and SWAP usage value
	$memusage_pct = mem_usage();
	$swapusage_pct = swap_usage();

	// Display memory usage
	echo "Memory Usage: " . $memusage_pct . "%" . PHP_EOL;
	echo "SWAP Usage: " . $swapusage_pct . "%" . PHP_EOL;

	// If memory usage is above 90% and SWAP usage is above 75%, stop and restart squid services.  
	if ((($memusage_pct > 70) && ($swapusage_pct > 50)) || ($memusage_pct > 55) ) {
		// stop e2g service
		exec("/usr/local/sbin/e2guardian stop");
		// stop squid service
		squid_stop_monitor();
		if (is_service_running('squid')) {
			stop_service("squid");
		}
                // start e2g service
		exec("/usr/local/sbin/e2guardian start");
		// start squid service
                squid_restart_services();
		log_error(gettext(sprintf("[squid] Memory usage is $memusage_pct percent and SWAP usage is $swapusage_pct percent, stopping and restarting services.")));
	}
?>

Thanks! I see you left the code for Squid there too, is there really a need to kill off squid too? From what I've seen, restarting E2 Guardian works just fine.

So, I ended up just adding the e2g block. :D

pfsensation

I'm starting to experience system dumps again. Anyone else experiencing the same? Very strange… I've already clean installed.

marcelloc

@pfsensation:

I'm starting to experience system dumps again. Anyone else experiencing the same? Very strange… I've already clean installed.

I've compiled the binaries again with the little changes from previous 4.1.2_2 we were using to 4.1.3. I don't expect any change on process behavior from last update but I've compiled it anyway to keep this project with the latest updates from e2guardian.

pfsensation

@marcelloc:

@pfsensation:

I'm starting to experience system dumps again. Anyone else experiencing the same? Very strange… I've already clean installed.

I've compiled the binaries again with the little changes from previous 4.1.2_2 we were using to 4.1.3. I don't expect any change on process behavior from last update but I've compiled it anyway to keep this project with the latest updates from e2guardian.

https://pastebin.com/zdMs98Zy It's now crashing often again… Only thing that changed is I think at one point there was a unexpected loss of power to the machine. Could this be it?

pfsensation

Marcello can you take a look at the dump? Also how can I fully clean all files left over by E2Guardian? It's really annoying, I don't want to keep reinstalling pfSense…That sucks.

marcelloc

@pfsensation:

Also how can I fully clean all files left over by E2Guardian?

Uninstall the package will remove xml files and bsd package. /usr/local/etc/e2guardian will keep some files and e2guardian options will stay on xml.

marcelloc

Great news!

v5-testing has the ssl filtering

bedmakaveli

Hello guys,
here I am again :) .
After setting all up, and get E2guardian working correctly, I would love to redirect to the courtesy page also for https pages.
I've read a lot of posts without finding something clear.
I'm using explicit proxy setting, so i don't need the MITSSL, or at least I think so.
There is a way to redirect the https pages to the courtesy page visualized on blocked http traffic or should i lose my hopes?

Thanks marcelloc for all the work, I'll repay the efforts with a lot of coffes :)

PS: sorry for the repost, maybe here is the correct place for this kind of question :)

marcelloc

Take a look on report options. You can redirect to a external url or chance current template.

bedmakaveli

@marcelloc:

Take a look on report options. You can redirect to a external url or chance current template.

Thanks marcelloc for the reply.
But how can I redirect to the report page when I try to access to an https site?
It seems to work only for http sites.

marcelloc

@bedmakaveli:

@marcelloc:

Take a look on report options. You can redirect to a external url or chance current template.

Thanks marcelloc for the reply.
But how can I redirect to the report page when I try to access to an https site?
It seems to work only for http sites.

Intercepting SSL. You can setup it on group settings but you need to install certificate authority on clients.