Issue with SG-3100 and 22.01? [Solved]

FSC830

Actually I cant remember if it was really 404... .
But now I have noticed another strange "issue?"...

Just looked up the memory use, and noticed a big difference of usage from 22.01 compared to 22.05.
Can someone confirm this behaviour?
In 22.05 memory usage is signifcant higher?
22.01 free abt 80%, 22.05 abt 30%?
And the "inactive" vice versa from 7.5% to 60%?

Regards

pwyde

@fsc830

For me it was not 404, but website could not be reached.

I have the exact same memory usage as you, comparing 22.01 and 22.05.

stephenw10

Has it been rebooted since the update? The update process itself uses a lot of RAM. That would normally be freed over time or if required. Rebooting it should show similar usage to 22.01.

Steve

FSC830

an EBKAC error ... (Error Between Keyboard And Chair)

Just rebootet:

Regards

FSC830

I am rather sure I found the cause for the issue..
Today it was (nearly) the same, no internet access, no name resolution, but pfSense GUI was still available. That was slighty different. And a running internet stream was still active!?

Anyhow, the appliance was rebootet at July 2nd after installing v22.05.
And since then I used the widget for the used disk capacity.
Some months ago (could be shortly after installing 22.01) I used the option "use RAM disks" for /tmp and /var.

Since last reboot I noticed, that /var is getting more and more full. I was curious if there is any process which frees up filesystem at a certain level.
No, it wasnt. This morning /var was filled up by 100% (may be 99.99% and thats, why it was slighty different this time).

Anyhow, administration via GUI was possible and I disabled the RAM disks.
Now I am curious, what will happen next, in Disk widget there is only / (root) and /var/run visible.
With 22.05 I installed also a m2.ssd with 128gb, my guess is, that this should not run out of space- hopefully.

Regards

Edit: nothing seen at console, last entry was a login notification from July 12th, and next is the reboot from today. At least I have had expected some warning about the 100% file system usage.

stephenw10

@fsc830 said in Issue with SG-3100 and 22.01?:

This morning /var was filled up by 100% (may be 99.99% and thats, why it was slighty different this time).

Ah, yes, that would do it. You will find services start to fail slowly as they cannot restart.

If you enable RAM disks you need to be aware of the reduced space and that fact that some packages are expected to work with them.
What RAM disks sizes are you using? What packages do you have installed?

Something is probably logging in an uncontrolled manner, not cycling the logs correctly.

Steve

FSC830

Hi Steve,

RAM disk size was set to double of the default values, 80 and 120 MB (default 40/60).
Installed packages:
apcuspd
cron (installed, but yet not used)
ipsec profile wizard
mailreport
nut
openvpn wizard
pfBlockerNG
Snort
Status Traffic Totals
System Patches (patches still existing after latest update: IPsec PKCS#11 support as an optional feature and Hide pcscd service from the service list if IPsec PKCS11 | support is disabled)
Wireguard

But RAM disk is disabled now.

Regards

stephenw10

Ah, yeah almost certainly Snort there. Really the Snort and Suricata packages are not expected to work with RAM disks. It's possible but you have to have to be very careful configuring it.

Steve

FSC830

I am convinced the RAM disk full situation was causing the whole issue at my end.
System is now up and running for 30 days, since enabling the RAM disk the runtime was not longer than 20/21 days.
Now, with disabled RAM disk, the system uptime exceeds this timeline clearly.
I remember that the uptime prior the update to 22.01 was 180 days (or something around that).
With the update to 22.01 I enabled RAM disk usage, that was a mistake.

Is there a way to mark the thread "solved"? I did not find any option for that.

Regards

stephenw10

@fsc830 said in Issue with SG-3100 and 22.01?:

Is there a way to mark the thread "solved"?

No, but I can edit the title if you wish?

FSC830

@stephenw10
Yes, go ahead please and add a - solved at the end (or at the beginning).

Regards