More on Abnormally High CPU Usage

Courierdog

Re: Recent upgrade to 22.01 - High CPU usage?

Running a Netgate-2100, version 22.05.
On the dashboard it is showing the CPU usage >90%.
Packages currently installed are as follows:
arpwatch
aws-wizard
bandwidthd
ipsec-profile-wizard
mailreport
pfBlockerNG-devel

Looking at Diagnostics -> System Activity, it is showing the CPU Activity as follows:
last pid: 29379; load averages: 2.21, 2.35, 2.28 up 1+14:42:03 11:50:43
167 threads: 5 running, 134 sleeping, 8 zombie, 20 waiting
CPU: 48.3% user, 0.8% nice, 50.0% system, 0.6% interrupt, 0.2% idle
Mem: 76M Active, 148M Inact, 272M Wired, 125M Buf, 2816M Free

I would appreciate any suggestions how to decrease the CPU usage to my former 10 - 20% with the same installed packages.

NOCling

https://redmine.pfsense.org/issues/13154

File: /usr/local/pkg/pfblockerng/pfblockerng.inc

Line: 4139

From:
$r = explode(')', $result, 2);

To:
$r = explode(' ', $result, 2);

Courierdog

@nocling
This programming change is performed from the console, rather than from the Dashboard GUI, correct.

Courierdog

@nocling
I also have to ask, what exactly are we changing, and in what installed package is the change being applied to.
Now, I also have to ask as I am very new to pfsense, why are we making this change and what is it intended change to the application intended to do.

NOCling

All information in the redmine, klick the link.

SteveITS

@courierdog said in More on Abnormally High CPU Usage:

This programming change is performed from the console, rather than from the Dashboard GUI, correct.

In the GUI you can use Diagnostics/Edit File.

Per the redmine, there was a logging change in 22.05 which created a bug in pfB and that is the fix, since pfB hasn't been updated since then.

Courierdog

@steveits
Steve, I have to be very careful here as I said I am very new to pfsense.
Diagnostics / Edit File
Advanced Users Only
The capabilities offered here can be dangerous.
No support is available. Use them at your own risk!

Save / Load a File from the Filesystem

(Path to file to be edited) ..................................................
Load - Browse - Save - GoTo Line #

Sorry, but in my case I require exact instructions, so I can write it down, save it for potential future use, or to correct my mistakes.

Thanks for being patient with a newbie

SteveITS

@courierdog
in "file to be edited" enter /usr/local/pkg/pfblockerng/pfblockerng.inc
click Load
next to "go to line #" enter 4139 and press that "go to line #" button
change the line as noted above
click Save

I believe at that point you should Diagnostics/Reboot to ensure the change has been loaded. Not sure that's required but it won't hurt.

https://docs.netgate.com/pfsense/en/latest/diagnostics/edit-file.html

Courierdog

@steveits
Steve
I followed your instructions however line 4139 does not have anything close to the previous code
as noted bt NOCling https://redmine.pfsense.org/issues/13154

File: /usr/local/pkg/pfblockerng/pfblockerng.inc
Line: 4139
From:
$r = explode(')', $result, 2);
To:
$r = explode(' ', $result, 2);

$r = explode(')', $result, 2);

this coding is Not found plus or minus 50 lines in my version (22.05)

Perhaps if you gave me the code line 10 line before and 10 line after the desired code I may be able to scan and locate the desired code of r = explode

Or the Code sequence that this small change is part of.

I will not just drop the suggested code anywhere as the instructions are very specific:
FROM - $r = explode(')', $result, 2);
TO - $r = explode(' ', $result, 2);

NOCling

My 2100:

Its there.

22.05-RELEASE (arm64)
pfBlockerNG-devel 3.1.0_4

SteveITS

@courierdog What version of pfBlockerNG-devel do you have? 3.1.0_4 is the latest.

$rule_list		= array();
$rule_list['id']	= array();
$rule_list['other']	= array();
$rule_list['int']	= array();

exec("{$pfb['pfctl']} -vvsr 2>&1", $results);
if (!empty($results)) {
	foreach ($results as $result) {
		if (substr($result, 0, 1) == '@') {

			$r = explode(')', $result, 2);

			// pfSense > v2.6 uses an 'ridentifier' string
			if (strpos($result, 'ridentifier') != FALSE) {
				$id = trim(strstr(strstr($r[1], 'ridentifier', FALSE), ' ', FALSE));
			} else {
				$id = ltrim(strstr($r[0], '(', FALSE), '(');
			}

			// Find rule descriptions and type for pfBlockerNG Tracker IDs
			if (strpos($r[1], ' <pfB_') !== FALSE) {
				$descr	= ltrim(stristr($r[1], '<pfb_', FALSE), '<');
				$descr	= strstr($descr, ':', TRUE);
				$type	= strstr(trim($r[1]), ' ', TRUE);
				if ($type == 'match') {
					$type = 'unkn(%u)';
				}

Courierdog

@steveits
pfBlockerNG-devel net 3.1.0_4

And I am not finding the coding you are listing.

This is beginning to scare the life out of me.
pfsense was recommend to be as a solution to all the crap I have been going through.
It certainly has removed 99.9% of the issues.
I noticed that I was getting notifications from MaxMind stating I required a license.
In another blog it suggested an update to the pfBlocker which I did, and it worked for about 30 minutes and then I noticed the increased CPU Usage.
Which has alarmed me, as I do not want to be running the CPU at excessive usage and possible risk overheating the device.
It was that the other day when I logged in I noticed the CPU usage had gone totally mad as it has bee typically less than ten with the occasional burst to 40% for a second.

Courierdog

@steveits
I now notice the following notifications at the bottom of the page
= Update = Current

= Remove = Information = Reinstall

Newer version available

Package is configured but not (fully) installed or deprecated.

I have been working my way through the book SAFER @ Home by Michael Lines.
This is where he suggested I use PfBlocker as a means to block the obvious CyberAttack avenues.
So my setup ha only gone as far as he outlines in his book.

SteveITS

@courierdog The package page can be a bit confusing at first. The bottom is just a legend, but it doesn't say it's a legend. On this one the system patches package has an upgrade available, the others do not:

re: file, you have the right file? Did you CTRL+F it? Once I typo'd the "4139" and got myself confused.

stephenw10

@courierdog said in More on Abnormally High CPU Usage:

I now notice the following notifications at the bottom of the page
= Update = Current
= Remove = Information = Reinstall
Newer version available
Package is configured but not (fully) installed or deprecated.

That's just the key to the list of installed packages.

I assume you are seeing the file existing?

Courierdog

@steveits
once I enter and load the file I receive the following:
<?php
/*

pfblockerng.inc
part of pfSense (https://www.pfsense.org)

This tells me I have loaded the pfblockerng
code
I enter the Line Number 4139 and press ENTER
I arrive at the following:
// Create update file indicator for update process
touch("{$pfb['dbdir']}/{$filename}/{$filename}.update");
} else {
pfb_logger('.', 1);
exec("/usr/bin/gunzip -c {$file_dwn}.raw > {$file_dwn}.orig", $output, $retval);
}
}
elseif ($file_type == 'application/x-bzip2') {
pfb_logger('.', 1);
exec("/usr/bin/bzip2 -dkc {$file_dwn}.raw > {$file_dwn}.orig", $output, $retval);
}
elseif ($file_type == 'application/zip') {

		// Extras - MaxMind/TOP1M downloads
		if ($type == 'geoip' || $type == 'top1m') {
			// Determine if Zip contains multiple files
			exec("/usr/bin/tar -tf {$file_dwn}.raw 2>&1", $archive_count, $retval);
			if ($archive_count[0] == 'tar: Failed to set default locale') {
				unset($archive_count[0]);

SteveITS

You could always remove and reinstall the package. By default it keeps its settings.

CTRL+F should find "$r = explode(')', $result, 2);" only once. It's several scrolls/pages below the code you posted.

Courierdog

@steveits
Steve, I was just going to say the code you listed is several pages below where I came up at 4139 on my computer.
I use a MacBook Pro
And I stand corrected when I enter the page #4139 I hit enter (return)
I will now go to the file as you described and wait for further instructions.

Courierdog

@nocling
OK
I finally did find the files as you and Steve posted.
They are several pages below where I landed after entering 4139 and pressing enter.

The FROM and TO that has been suggested.
If I do this from the GUI
FROM $r = explode(')', $result, 2);
TO. $r = explode(' ', $result, 2);

Is this a matter of typing over the existing code as displayed and pressing SAVE

Or is there something else I must do.

I have never edited the pfsense code directly only configured the install set up from the GUI

SteveITS

@courierdog said in More on Abnormally High CPU Usage:

Is this a matter of typing over the existing code as displayed and pressing SAVE

Yes.

If it breaks, edit the file back again, or just uninstall/reinstall the package to get the original file. (you could, say, copy/paste the entire field into a file on your PC)