2.4.5.a.20200110.1421 and earlier: High CPU usage from pfctl

Auror990

Same issue, Server 2019 and Hyper-V, no packages installed on custom HW (Ryzen 2700) after upgrade. Pegs CPU upon boot and is basically unusable.

Set VM to 1 virtual processor to get it working but it is sub-optimal for OpenVPN clients. Even experimented with just assigning 2 virtual processors - it runs sluggish.

~~Will look to revert to 2.4.4-p3 snapshot in the near future.~~

Edit: since I had nothing to lose and this is in a test lab, I bumped up to 2.5.0 development (2.5.0.a.20200403.1017). 2.5.0 does not seem to have the Hyper-V CPU issue.

Cool_Corona

Its the same in a VM on Vsphere. I run 32 cores on a test system and they all go to almost 100% shortly after boot.

I noticed that the server started spinning its fans a lot harder and looked in the hypervisor and sure enough. Almost 100% and not handling traffic at all....

I was running 2.4.4 p3 and no issues until Suricata wont start. Then I had to upgrade and it died....

kiokoman

i made a clean install on my esxi with 4 cpu
and upgraded from 2.4.4-p3 to 2.4.5 on another server with qemu/kvm with 4 cpu westmere
both have suricata installed, never had such a problem. and i'm unable to reproduce on my test lab, must be some settings

timboau 0

Same problem here too Hvper V 2016 version 2.4.5
5GB RAM
4 CPU
pfblocker NG

Sits for ages on 'firewall' & Also DHCPv6 before booting really sluggish dropped packets galore

Dropped back to single CPU and all ok on 2.4.5

slim2016

Same problem, pfsense 2.4.4 installed on Vmware Esxi. I have suricata, pfblockerng, squid, squidguard and lightsquid installed. After upgrading to 2.4.5 the latency went haywire. However, I've managed resolve my problem, I reduced 8 vcpu to 1vcpu then did the upgrade to 2.4.5. So far everything worked fine except suricata wouldn't start, so i did a Forced pkg Reinstall. Everything worked fine after that, then I added an additional 3vcpu and it's been working fine ever since.

Uncle_Bacon

Same problem here but with a Proxmox VM on pfSense 2.4.5.
2 CPU, 2 core
8GB RAM
NUMA disabled

High CPU on "/sbin/pfctl -o basic -f /tmp/rules.debug" effectively killed my networks and VLANS, and both incoming WAN connections. pfSense would often crash and reboot automatically, which produces a crash report.

Dropping to 1 CPU, 1 core fixes it but it's running hard due to my network. 2.4.4_3 ran just peachy!

slim2016

@Uncle_Bacon Have you tried adding cpu later (after the upgrade)? I noticed that maximum vcpu is 4 before it starts going crazy.

Cool_Corona

@slim2016 said in 2.4.5.a.20200110.1421 and earlier: High CPU usage from pfctl:

@Uncle_Bacon Have you tried adding cpu later (after the upgrade)? I noticed that maximum vcpu is 4 before it starts going crazy.

I have upped it to 8 so far and it runs pretty stable. Havent noticed a crash report yet.

timboau 0

It doesn't work properly with more than one vCPU (in my experience)

slim2016

@Cool_Corona You are right, iv'e just added a total of 8 vcpu and gave it time to settle down after a boot, it seems to stabilise itself after a short while.

timboau 0

@slim2016 The point is its completely unstable with more than one cpu (when it doesn't work) including dropped packets.

This isn't acceptable to simply 'wait for it' to settle down. Also the boot times with multiple CPU are magnitudes slower that it should be, again not acceptable for a firewall.

If the root cause isn't determined are you happy for the firewall to randomly drop packets and generally die?

It's not happening for everyone but it is a bug and it needs to resolved.

The silence from NetGate is deafening. I understand its not happening on NetGate hardware - Does anyone have a subscription on a virtual machine that NetGate can address?

slim2016

@timboau-0 I was responding to Cool_Corona

Cool_Corona

@timboau-0 said in 2.4.5.a.20200110.1421 and earlier: High CPU usage from pfctl:

@slim2016 The point is its completely unstable with more than one cpu (when it doesn't work) including dropped packets.

This isn't acceptable to simply 'wait for it' to settle down. Also the boot times with multiple CPU are magnitudes slower that it should be, again not acceptable for a firewall.

If the root cause isn't determined are you happy for the firewall to randomly drop packets and generally die?

It's not happening for everyone but it is a bug and it needs to resolved.

The silence from NetGate is deafening. I understand its not happening on NetGate hardware - Does anyone have a subscription on a virtual machine that NetGate can address?

Its happening on Netgate hardware as well. They are not so fortunate to have the workaround reducing the number of cores as are the VM's.

Reducing it to 1 core and get it up and running stable is no problem. Then add cores as you like.

Yes the boot time is quicker with 1 core then with 8 cores.

Yes I would like it to be resolved as well. I think its an BSD issue and therefore needs to be forwarded in the ECO system of BSD.

I am running 8 cores as of now and no issues so far.

Uncle_Bacon

@slim2016 I haven't tried that. Unfortunately my backups don't run as deep as they should so I have no 2.4.4 backup. I am going to try a fresh install and restore config from 2.4.5 to see if that helps. Thank you for the suggestion. It's nice to have the ability to create/re-create as many instances of it that I want. I'll post back.

slim2016

@Uncle_Bacon I haven't used Proxmox for many years and when I did it was for a short while. With Esxi you just create a snapshot before you upgrade or update and if something goes wrong you just restore the snapshot.

Cool_Corona

@Uncle_Bacon said in 2.4.5.a.20200110.1421 and earlier: High CPU usage from pfctl:

@slim2016 I haven't tried that. Unfortunately my backups don't run as deep as they should so I have no 2.4.4 backup. I am going to try a fresh install and restore config from 2.4.5 to see if that helps. Thank you for the suggestion. It's nice to have the ability to create/re-create as many instances of it that I want. I'll post back.

Install everything with 1 CORE only! After you are done and the backup is on the box, then reboot, install packages, reboot and upgrade number of cores.

Uncle_Bacon

@slim2016 It's the same for Proxmox but I guess I need to get back in to the habit of doing that before any updates, especially to pfSense.

@Cool_Corona Done and done. Back up and running and have my metric server monitoring and will notify of any issues that may arise. Fingers crossed!

slim2016

@Uncle_Bacon Keep us updated about the stability of your system.

slim2016

I just noticed that pfsense doesn't start properly after installing arp-watch, some of the services wouldn't start, after removing it everything started fine.

Uncle_Bacon

So just a quick update.

For some context, this problem originally only started when one of my WAN connections dropped and pfSense failed over to the other. So I went to do some testing. I disconnected one gateway and it switched to the other with moderate CPU use and then continued on to normal levels. Upon reconnecting it however, pfSense switched back to my main WAN and I noticed the pfctl process running high CPU and all sorts of notifications about that from my metrics. Latency on all of my network connections increased 10 fold as well and barely anything was getting through the network.

If I recall when I installed this newest update, the router ran fine for a while, at least since the start of April before this problem came up more recently.

I am not overly confident that either a) my having to reinstall and restore from a 2.4.5 config was successful or b) the issue isn't solved by only adding more CPUs/cores after the upgrade. or OR my configuration is unique/flawed.

I'll keep posting updates as they come in.