Swap usage

Walter5623 · Jul 12, 2020, 5:29 AM

Hi,

My swap usage is running around 90% and I believe i may have caused a few crashes latly. I run Sg-5100 with open VPN, Snort, Squid and ntopng with 4Gb RAM.

I had some peaks in ram usage but currently running steady at 30%. Still zith high swap usage (90% 372 MiB). Would useing RAM Disks help? Any other ideas?

Cheers

Walter5623 · Jul 12, 2020, 5:46 AM

System log:
Jul 12 12:45:24 kernel swap_pager_getswapspace(32): failed
Jul 12 12:45:24 kernel swap_pager_getswapspace(32): failed
Jul 12 12:45:24 kernel swap_pager_getswapspace(32): failed
Jul 12 12:45:24 kernel swap_pager_getswapspace(24): failed
Jul 12 12:45:24 kernel swap_pager_getswapspace(32): failed
Jul 12 12:45:24 kernel swap_pager_getswapspace(24): failed
Jul 12 12:45:24 kernel swap_pager_getswapspace(32): failed
Jul 12 12:45:24 kernel swap_pager_getswapspace(24): failed
Jul 12 12:45:24 kernel swap_pager_getswapspace(12): failed
Jul 12 12:45:24 kernel swap_pager_getswapspace(32): failed
Jul 12 12:45:24 kernel swap_pager_getswapspace(24): failed
Jul 12 12:45:24 kernel swap_pager_getswapspace(18): failed
Jul 12 12:45:24 kernel swap_pager_getswapspace(32): failed
Jul 12 12:45:24 kernel swap_pager_getswapspace(24): failed
Jul 12 12:45:24 kernel swap_pager_getswapspace(18): failed
Jul 12 12:45:24 kernel swap_pager_getswapspace(14): failed
Jul 12 12:45:24 kernel swap_pager_getswapspace(32): failed

I may have created a situation where my ram was fully used. But would have expected after the forced reboot that this would be fixed

DaddyGo · Jul 12, 2020, 3:57 PM

@Walter5623 said in Swap usage:

372 MiB

Hi,

High swap usage with a 4GB RAM, may indicates problems.
(if it really is, let’s just read on in my comment)

I would first suspect Squid about swap....but

@Walter5623 "Would useing RAM Disks help?"

Using RAM disks will cause additional problems.
Not many collegues recommend it... (Uncontrolled exhaustion of RAM disks, causing additional problems)

-the first thing you can do is observe what fills the swap area...
-secondly, my question is - you wrote that 90% = 370MiB - the pfSense installation default is 2G - did you change that? (if only the base disk is not very small)

-thirdly - increases the swap area based on similar descriptions as this:
https://forum.netgate.com/topic/107375/howto-remove-swap-post-install-and-resize

bmeeks · Jul 19, 2020, 5:54 PM

@Walter5623 said in Swap usage:

Hi,
Would useing RAM Disks help? Any other ideas?

Cheers

Using RAM disks will make your problem orders of magnitude worse! Do you know what swap is for and what it actually is?

Swap memory is a type of temporary RAM. When there is not enough physical RAM to hold the information the currently running processes are using, the operating system will cycle currently idle sections of RAM out to a special file on the disk. So any currently loaded process that happens to be sleeping or otherwise not actively using CPU at that exact instant can have some or all of its data removed from RAM and written to the swap file on disk to free up RAM for use by another active process. Then, when that sleeping process "wakes up" and starts execution again, the operating system reads its data from the swap file and copies it back into RAM. This is an extremely slow set of processes compared to keeping the data in RAM the whole time. So usage of swap is basically to be avoided. When you start using swap, things are going to get very slow very fast.

A RAM disk uses part of RAM to hold data that is normally written to disk. So you would be taking up even more precious RAM to act as a disk drive and thus increase the operating system's need to use the swap file. You leave the OS even less free RAM to use for processes since a RAM disk reserves some RAM to be a disk drive. RAM disks today are generally a bad idea on pfSense. I suggest you avoid using them altogether.

As @DaddyGo mentioned, you are using some memory intensive packages. 4 GB of RAM is really not all that much for the packages you have. Are you sure you really need Squid? With the widespread use of HTTPS today, the utility of caching with Squid is reduced unless you are using some type of MITM. Squid can use a lot of disk space, too. The ntopng package can also be quite resource intensive as can Snort. So together, all those packages can give your firewall a real workout with only 4 GB of RAM available. That's why your firewall is resorting to use swap space, and it is having trouble even with that. This is because swap space is configured during pfSense installation and is a fixed size. Your error messages indicate you are exhausting your swap file space.