Pfsense Log rotation issues - high bzcat CPU
-
Hello,
the 'bzcat' processes have started to use a combined of 100% CPU.
I have disabled logging on all the rules as a test, but still the same.
I have also disabled pfBlockerNG, but still the same.The dashboard is not accessible at all when the CPU spikes (the firewall log widget probably causing it), also the firewall logs via GUI are also not accessible. Not ever, not even when the CPU calms down for a minute or two, which is when I can login to any other page but /index.php because dashboard.
CPU:
Appears to be a log cycle issue. The log settings:
The log files appear huge.
We're not using ZFS, turning off compression probably not the best idea.
There's also this shiny red button that I have not pressed yet:
Pfsense is running on a VM and version is:
Any hints appreciated!
-
@Luce321 As the message says "Compressing rotated log files saves disk space, but can incur a performance penalty."
Turn off log compression.
-
True, however, I'd need to find out approx. how much more space it will use up.
Going from a mediocre performance due to compression to a disk full, would be quite the opposite of fixing the issue.There is 2.5GB available currently.
-
@Luce321 Alternatively, choose a different compression algorithm. Zstd is good choice for performance.
-
@Luce321 700 MB seems rather large but the logs also go back 2 months? Typically with high log usage the problem is either no rotation (large log/rotation size) or way too much rotation (lots of writing to logs and it can't keep up).
Is this on an SSD?
discussion of compression and when to not use it:
https://docs.netgate.com/pfsense/en/latest/monitoring/logs/settings.html#log-rotation-settings -
Yeah it should never reach that size. It's probably unable to rotate them because of the compression time taking longer than the rotation time.
I would clear the log files and disable compression. Or increase the log size and reduce the amount logging so they aren't rotating as often.
