Strange Error with pfSctl

fireodo

Hi,

since maybe 2 weeks (without any change made to pfsense) I get those errors:

Apr 28 03:05:05 pfsense pfSctl[36882]: could not finish read in a reasonable time. Action of event might not be completed.
Apr 30 03:05:08 pfsense pfSctl[13129]: could not finish read in a reasonable time. Action of event might not be completed.
May  1 03:05:08 pfsense pfSctl[75391]: could not finish read in a reasonable time. Action of event might not be completed.

I have no clou what this error means and what it is related too. pfSctl seams to be (according to Gugl) something specific for pfsense and not freebsd ...

Maybe someone knows more?

Thanks, fireodo

stephenw10

In 2.6 on that i5?

That's the only error logged?

It's probably some pfctl command that's taking too long to respond. Do you have a very large number of rules or states?

Steve

fireodo

@stephenw10 said in Strange Error with pfSctl:

In 2.6 on that i5?

Yes

That's the only error logged?

Yes, nothing more.

It's probably some pfctl command that's taking too long to respond. Do you have a very large number of rules or states?

No, its a home firewall. And pfblocker has also not very much feeds.

Steve

fireodo

stephenw10

Are you able to trigger those errors?

If you can you could try to see what the command being run there that's causing it using ps -auxwwd at the CLI.

Steve

fireodo

@stephenw10 said in Strange Error with pfSctl:

Are you able to trigger those errors?

No

If you can you could try to see what the command being run there that's causing it using ps -auxwwd at the CLI.

I can see they appear only when de WAN-IP Renew occurs (thats about 03:05 am)

Edit: Maybe it has to do with the fact that the box has 157 days uptime and memory is at about 90% and SWAP is in use at 4% (just a thought)

Steve

fireodo

stephenw10

Hmm, well if it's hitting SWAP that will slow everything down significantly.

Do you have the recommended patches applied?

fireodo

@stephenw10 said in Strange Error with pfSctl:

Hmm, well if it's hitting SWAP that will slow everything down significantly.

You're right - that could be the explanation!

Do you have the recommended patches applied?

Yes.

In the mean time I stopped the machine (I intended anyway to renew the thermal compound at the CPU) and now (as expected) the SWAP is not anymore in use. I keep an eye on that and report.

fireodo

@stephenw10 said in Strange Error with pfSctl:

Hmm, well if it's hitting SWAP that will slow everything down significantly.

Now after a few days the error didnt come back - RAM exhaustion and SWAP usage seams to be the culprit for that error. Hoping that the Memory leak in 2.6.0 is closed in 2.7.0 (Memory leak)