pfsense crash

[v0id]

Hello, today have encountered this crash. What depends on? Is it an hacking attempt?

Crash report begins. Anonymous machine information:

amd64
11.2-RELEASE-p10
FreeBSD 11.2-RELEASE-p10 #9 4a2bfdce133(RELENG_2_4_4): Wed May 15 18:54:42 EDT 2019 root@buildbot1-nyi.netgate.com:/build/ce-crossbuild-244/obj/amd64/ZfGpH5cd/build/ce-crossbuild-244/pfSense/tmp/FreeBSD-src/sys/pfSense

Crash report details:

PHP Errors:
[28-Sep-2019 17:31:01 Etc/UTC] PHP Fatal error: Allowed memory size of 402653184 bytes exhausted (tried to allocate 63448770 bytes) in /usr/local/www/csrf/csrf-magic.php on line 161
[28-Sep-2019 17:31:51 Etc/UTC] PHP Fatal error: Allowed memory size of 402653184 bytes exhausted (tried to allocate 63448770 bytes) in /usr/local/www/csrf/csrf-magic.php on line 161
[28-Sep-2019 17:33:52 Etc/UTC] PHP Fatal error: Allowed memory size of 402653184 bytes exhausted (tried to allocate 63448770 bytes) in /usr/local/www/csrf/csrf-magic.php on line 161

No FreeBSD crash data found.

[provels]

@v0id Maybe logging run wild and ran out the disk? What packages?

[v0id]

This post is deleted!

[v0id]

@provels Have installed pfBlocker and snort. Seen that swap memory is full have 3.8GB swap and 100GB hdd. Previously used: "swapoff -a; swapon -a" for clean swap memory. Is it possible to add more space to swap? Have 4GB ram on my appliance and would at least double it.

[provels]

Have you checked the size of /var where logfiles are kept? Is snort logging limited? I don't run Snort, but I run pfBNG on a 4GB disk with only 1.5GB of RAM without issue and never get into swap.

[v0id]

logs size are ok, experience the problem when open with browser https//192.168.1.1/snort/snort_rules.php

[provels]

Yeah, might be better off posting directly to the IDS/IPS forum. No expert with Snort.

[v0id]

ok, thanks

[stephenw10]

If you're using swap at all you have a problem. pfSense should not use swap in normal operation and if it does performance can be very degraded.
Work out what is actually using your RAM and tune that out.

Steve