Running Suricata causes swap_pager_getswapspace failed
-
swap_pager_getswapspace(32): failed
top -aSHThe swap space is 99% in use. what should I do to resolve the swap_pager_getswapspace error?
-
@eva You might read through https://forum.netgate.com/topic/175527/snort-swap_pager_getswapspace-13-failed, it's probably the same ideas.
Since you've cut off the process list what are the 3 processes using all that CPU and RAM? By any chance is it logging? If you have slower CPU or storage, or are using ZFS, turn off log compression.
-
Looks like you have used all the RAM and then all the SWAP. On a system with 2GB RAM you need to configure Suricata carefully to avoid that. You can't just enable every ruleset and every rule in that.
As a general rule pfSense should not use SWAP at all. If it is you probably have something misconfigured. Performance will drop significantly as when SWAP is in use.Steve
-
Agree with what others have already posted: you need to either significantly trim the rules you have enabled in Suricata or else bump up the RAM in the machine to at least 4 GB - and 8 GB is even better. But even with 4 GB of RAM, you will still want to carefully select the Suricata rules you enable.
And as mentioned, once your box starts using swap space, performance goes quickly into the toilet.
