Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    There were error(s) loading the rules: pfctl: DIOCADDRULENV: Device busy

    Scheduled Pinned Locked Moved
    General pfSense Questions
    6
    55
    2.8k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • stephenw10S
      stephenw10 Netgate Administrator
      last edited by

      Hmm, OK. 2x too many!

      Do you know if it remains responsive at the console when that happens?

      A 1 Reply Last reply Reply Quote 0
      • A
        a.dresner @stephenw10
        last edited by

        @stephenw10 I wish I could say, but its a remote location and has only acted this way when I'm not on site... last time was 24 hours after I left...frustrating

        1 Reply Last reply Reply Quote 0
        • stephenw10S
          stephenw10 Netgate Administrator
          last edited by

          Are you able to upload a status file to us to review?

          A 1 Reply Last reply Reply Quote 0
          • A
            a.dresner @stephenw10
            last edited by

            @stephenw10 of course, pls tell me what to do =)

            1 Reply Last reply Reply Quote 0
            • stephenw10S
              stephenw10 Netgate Administrator
              last edited by

              Great, you can pull the status_output file from the GUI. See:
              https://docs.netgate.com/pfsense/en/latest/recipes/diagnostic-data.html#view-and-download-diagnostic-data-in-the-gui

              Then upload it here:
              https://nc.netgate.com/nextcloud/s/YfciQktBin7fLEM

              A 1 Reply Last reply Reply Quote 0
              • A
                a.dresner @stephenw10
                last edited by

                @stephenw10 All done sir

                1 Reply Last reply Reply Quote 0
                • stephenw10S
                  stephenw10 Netgate Administrator
                  last edited by

                  Great I see that. Checking....

                  1 Reply Last reply Reply Quote 0
                  • stephenw10S
                    stephenw10 Netgate Administrator
                    last edited by

                    Mmm, OK nothing obvious there. I'm going to consult developers on this.

                    1 Reply Last reply Reply Quote 0
                    • stephenw10S
                      stephenw10 Netgate Administrator
                      last edited by

                      Ok, the likely cause here is a race condition between filter reloads triggered close to simultaneously.

                      That obviously shouldn't happen but you can probably mitigate it by tuning your gateway parameters for the WG_VPN_HQ gateway. Currently that is continually throwing alarms and reloading the filter every time it does. I suspect when you see this error it ends up thowing several alarms and queing up reloads.

                      I would try either setting the monitoring values to far higher numbers, say 50% and 500ms, or disabling monitoring action on the gateway. If that prevents or reduces the errors you're seeing that would prove the theory.

                      Steve

                      A 1 Reply Last reply Reply Quote 0
                      • A
                        a.dresner @stephenw10
                        last edited by

                        @stephenw10 From a troubleshooting standpoint, it makes sense since these overseas vpn can have spotty connection from time to time. I already made those adjustments... waiting to see what happened :D Thanks @stephenw10 much appreciated!

                        1 Reply Last reply Reply Quote 1
                        • W
                          wblanton
                          last edited by

                          I’m also seeing this message pop up a lot recently on one of my 23.09.1 firewalls. I’m counting 8 messages between 4/15 to today (4/28).

                          It’s always an alert saying:

                          There were error(s) loading the rules: pfctl: DIOCADDRULENV: Device busy - The line in question reads [0]:

                          Followed by another alert saying:

                          PF was wedged/busy and has been reset.
                          1 Reply Last reply Reply Quote 0
                          • stephenw10S
                            stephenw10 Netgate Administrator
                            last edited by

                            Same question as the OP here. Anything logged? Any 'exotic' rules? Anything else unusual?

                            1 Reply Last reply Reply Quote 0
                            • M
                              mangelot
                              last edited by

                              Same issue here, almost every day (some times twice a day)

                              06:30:00 PF was wedged/busy and has been reset.
                              06:30:00 There were error(s) loading the rules: pfctl: DIOCADDRULENV: Device busy - The line in question reads [0]:

                              system general log
                              Aug 26 06:30:00 php-cgi 51879 rc.filter_configure_sync: New alert found: There were error(s) loading the rules: pfctl: DIOCADDRULENV: Device busy - The line in question reads [0]:
                              Aug 26 06:30:00 php-cgi 51879 rc.filter_configure_sync: New alert found: PF was wedged/busy and has been reset.
                              Aug 26 06:28:00 sshguard 54936 Now monitoring attacks.
                              Aug 26 06:28:00 sshguard 55063 Exiting on signal.

                              1 Reply Last reply Reply Quote 0
                              • stephenw10S
                                stephenw10 Netgate Administrator
                                last edited by

                                Is there anything else logged? An alert shown in the system?

                                Can you replicate it by running Status > Filter Reload?

                                1 Reply Last reply Reply Quote 0
                                • M
                                  mangelot
                                  last edited by

                                  Only the warning in GUI and by email (twice a day)

                                  yesterday
                                  16:15:00 PF was wedged/busy and has been reset.
                                  16:15:00 There were error(s) loading the rules: pfctl: DIOCADDRULENV: Device busy - The line in question reads [0]:
                                  19:00:00 PF was wedged/busy and has been reset.
                                  19:00:00 There were error(s) loading the rules: pfctl: DIOCADDRULENV: Device busy - The line in question reads [0]:

                                  monday:
                                  06:30:00 PF was wedged/busy and has been reset.
                                  06:30:00 There were error(s) loading the rules: pfctl: DIOCADDRULENV: Device busy - The line in question reads [0]:
                                  01:30:00 PF was wedged/busy and has been reset.
                                  01:30:00 There were error(s) loading the rules: pfctl: DIOCADDRULENV: Device busy - The line in question reads [0]:

                                  Q: Can you replicate it by running Status > Filter Reload?
                                  A: Cannot replicate the error, no issues when running filter reload, all rules are loaded normally

                                  I can provide the status_output file from the GUI

                                  1 Reply Last reply Reply Quote 0
                                  • A
                                    a.dresner
                                    last edited by

                                    Happened for me again 3x, on a different pfsense box..

                                    pf_busy

                                    PF was wedged/busy and has been reset. @ 2024-08-08 16:20:11
                                    PF was wedged/busy and has been reset. @ 2024-08-13 06:44:50
                                    PF was wedged/busy and has been reset. @ 2024-08-21 14:50:18
                                    Filter Reload

                                    There were error(s) loading the rules: pfctl: DIOCADDRULENV: Device busy - The line in question reads [0]: @ 2024-08-08 16:20:12
                                    There were error(s) loading the rules: pfctl: DIOCADDRULENV: Device busy - The line in question reads [0]: @ 2024-08-13 06:44:51
                                    There were error(s) loading the rules: pfctl: DIOCADDRULENV: Device busy - The line in question reads [0]: @ 2024-08-21 14:50:19

                                    1 Reply Last reply Reply Quote 0
                                    • stephenw10S
                                      stephenw10 Netgate Administrator
                                      last edited by

                                      You can upload a status file here: https://nc.netgate.com/nextcloud/s/fLa8Rr8Km5Bq4rt

                                      M 1 Reply Last reply Reply Quote 0
                                      • M
                                        mangelot @stephenw10
                                        last edited by

                                        @stephenw10 uploaded the status

                                        1 Reply Last reply Reply Quote 0
                                        • stephenw10S
                                          stephenw10 Netgate Administrator
                                          last edited by

                                          Hmm, nothing obviously an issue there.

                                          You have a lot of bad requests against the pfSense GUI from a single IP. If that's not a scan of some sort from an internal IP you should check that you don't have open ports to the WAN.

                                          One in stance showed just after em2 disconnected. But only one.

                                          It looks like you have lcdproc installed but misconfigured.

                                          M 1 Reply Last reply Reply Quote 0
                                          • M
                                            mangelot @stephenw10
                                            last edited by

                                            @stephenw10

                                            bad requests against the pfSense GUI from a single IP?
                                            Can you tell me which IP? or which log file?

                                            It looks like you have lcdproc installed but misconfigured.
                                            I'm running lcdproc on a watchguard xtm550, the lcd is showing the correct info?

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post