pfsense is crashing when using Elementum, how can i read my log ?

micgo

Hello all

My pfsense(2.4.4-RELEASE-p3) is crashing when i use Elementum(torrent kodi addon). I do download torrent on my windows desktop and synology using download station but never had a crash. i know i can read log in system log. but what info i should be looking for ?

DaddyGo

@micgo said in pfsense is crashing when using Elementum, how can i read my log ?:

My pfsense(2.4.4-RELEASE-p3)

Hi,

torrents can cause more significant load + old version pfSense not a good pairing

upgrade to this version:
https://docs.netgate.com/pfsense/en/latest/releases/2-4-5-p1-new-features-and-changes.html

do not worry: includes a fix for "pfctl" and much more

BTW: do you run Snort or Suricata applications?

(looking in the logs "a crash report or crash dump in the shell" or anything that might indicate this)

micgo

Thank you for your reply Daddygo. i can tell i will learn something from this post already....... i have just finish updating to 2.4.5(P1). no i m not running Snort or Suricata. do u recommend me using it ? which one should i use ? i m still not understanding what do i need to do to look for crash report/dump

DaddyGo

@micgo said in pfsense is crashing when using Elementum, how can i read my log ?:

i have just finish updating to 2.4.5(P1). no i m not running Snort or Suricata. do u recommend me using it ? which one should i use ? i m still not understanding what do i need to do to look for crash report/dump

The system must always be on the current version

It is not necessary to run IPS / IDS in a SOHO environment.
Can be tried out as a curiosity, I would recommend Snort first in non-blocking mode.
I asked my questions about these applications, because they are resource intensive

and if misconfigured, under torrents can cause crashes, for example in IPS mode due to netmap.

I think we need to find a solution to the basic problem first.

You can deal with Snort, Suricata packages later. Bill's work is guidance @bmeeks in this case.
Bill is very enthusiastic about helping beginners as he is the maintainer of these packages and a very good professional and teacher.

The logs should be monitored immediately around the time of the collapse, as subsequent events may overwrite (or can mask) what happened.

You can do it here:

or on the shell (black) screen with a console connection

BTW:
an important question is, what kind of NIC do you use in pfsense? (Realtek (re) or Intel (igb, ix, etc.)
torrents can create high saturation and the poor quality hardware (ethernet controllers) can cause crashes...

+++edit:
logging in with SSH (WinSCP, Putty, etc.), you will also find system log files here
/var/log/
/var/log/system.log

stephenw10

Did you actually see a crash report? Normally indicated by an alert i the GUI after you reboot.

If not what exactly happened? pfSense became unresponsive? Even at the console?

Torrents typically cause problems because the open a lot of states. That can exhaust something on smaller pfSense boxes though just one torrent client is not normally anywhere near doing that.

Check the monitoring graphs (Status > Monitoring), look at the state usage in the time leading up to the incident.

Steve