Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Processor at 100% load due to snort sync

    Scheduled Pinned Locked Moved General pfSense Questions
    2 Posts 2 Posters 240 Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • I
      ioanv
      last edited by

      I'm running 2.4.3-RELEASE-p1 (amd64) on an AMD Athlon(tm) 64 X2 Dual Core Processor 3600+
      2 CPUs.

      I've noticed that at some point during the last few days, my pfsense processor went up to 100%.
      In the console I've run:

      [2.4.3-RELEASE][root@bastion1.localdomain]/root: ps auxww
      USER      PID %CPU %MEM     VSZ    RSS TT  STAT STARTED        TIME COMMAND
      root    42104 15.6  3.3  406204 136256  -  R    09:26       0:07.96 /usr/local/bin/php-cgi -f /tmp/snort_sync_cmds.php
      root    81405 15.1  3.4  402108 138688  -  R    09:25       0:16.43 /usr/local/bin/php-cgi -f /tmp/snort_sync_cmds.php
      root    78590 15.0  3.5  410300 145508  -  R    09:25       0:21.76 /usr/local/bin/php-cgi -f /tmp/snort_sync_cmds.php
      root    15840 14.9  2.6  369340 105424  -  R    09:26       0:10.46 /usr/local/bin/php-cgi -f /tmp/snort_sync_cmds.php
      root    49098 14.6  2.6  367292 106452  -  R    09:25       0:16.89 /usr/local/bin/php-cgi -f /tmp/snort_sync_cmds.php
      root    25532 14.2  3.3  406204 136788  -  R    09:26       0:08.19 /usr/local/bin/php-cgi -f /tmp/snort_sync_cmds.php
      root    28431 14.0  3.3  404156 136248  -  R    09:26       0:08.24 /usr/local/bin/php-cgi -f /tmp/snort_sync_cmds.php
      root    86075 13.8  3.4  408252 141720  -  R    09:25       0:15.43 /usr/local/bin/php-cgi -f /tmp/snort_sync_cmds.php
      root     6115 13.7  3.0  385724 123572  -  R    09:25       0:19.85 /usr/local/bin/php-cgi -f /tmp/snort_sync_cmds.php
      root    26405 13.5  3.2  393916 130400  -  R    09:25       0:18.02 /usr/local/bin/php-cgi -f /tmp/snort_sync_cmds.php
      root    25512 13.4  3.1  387772 126192  -  R    09:24       0:24.63 /usr/local/bin/php-cgi -f /tmp/snort_sync_cmds.php
      root    57326 11.8  2.8  377404 115248  -  R    09:25       0:15.67 /usr/local/bin/php-cgi -f /tmp/snort_sync_cmds.php
      root    18234 11.6  2.5  363068 100928  -  R    09:26       0:08.98 /usr/local/bin/php-cgi -f /tmp/snort_sync_cmds.php
      root    76254  8.0  1.4  309948  56464  -  R    09:27       0:01.36 /usr/local/bin/php-cgi -f /tmp/snort_sync_cmds.php
      root    81664  7.7  1.0  293564  42732  -  R    09:27       0:00.78 /usr/local/bin/php-cgi -f /tmp/snort_sync_cmds.php
      root    49657  1.7  0.8  287128  31976  -  S    03:06       5:12.68 php-fpm: pool nginx (php-fpm)
      root    40884  1.6  0.8  287128  32744  -  S    Sun14       2:06.11 php-fpm: pool nginx (php-fpm)
      

      I am unable to stop the snort process neither in the interface or in the command line.

      Any ideas?

      1 Reply Last reply Reply Quote 0
      • bmeeksB
        bmeeks
        last edited by bmeeks

        As a short-term fix disable Snort HA sync on the SYNC tab in Snort on the master firewall, and then reboot the slave firewall. That will stop the problem for now. That PHP file is created on the slave firewall by the master when "syncing" a Snort configuration from master to one or more slaves. That PHP file contains a series of commands for the slave to execute.

        Instead of rebooting, you can also try killing all those php-cgi process IDs. They are all trying to execute the same PHP file and likely stepping all over and blocking each other.

        1 Reply Last reply Reply Quote 0
        • First post
          Last post
        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.