pfSense 2.7.2 RAM leak (wired memory pool)

Gertjan

It can't be 'pfSense' (bare bone, no packages install). If it was, every pfSense being used out there would run out of memory every week. That's something that would edit : not happen without some one talking about it here on the forum.

zeroflow

@Gertjan

Thanks.
I would have figured as much, since that would be a much bigger issue affecting everyone.
I still kept wireguard, since that's needed for the S2S connection.

stephenw10

Check the Diag > System Activity page. What's using the RAM?

Or at the CLI check ps -auxwd or top -HaSP.

zeroflow

@stephenw10

I don't have all the details since I had to reboot yesterday.
But from the general stats right before the reboot:

Mem: 101M Active, 558M Inact, 2790M Wired, 56k Buf, 4550M Free

From previous investigations, I've been blaming unbound since that process has increased by a few MB.
But looking at it for a longer timeframe, the wired memory keeps increasing by ~100 MB per day. Everything else stays pretty much constant.

stephenw10

I would expect to see some specific process using it.

Are you able to test 2.8-beta? There's a good chance it's already fixed.

shoulders

@zeroflow What do you use to make those RAM graphs. I am running pfsense 2.7.2 and for a while it has been suffering similiar to you, runs for a while, then network start slowing right down until off, the GUI is inaccessible. I tnink also the CLI becomes unresponsivce and I have to use a restart command for the VM in TrueNAS.

I wrongly assumed it was a extension such as snort, did not think it might be pfsense.

stephenw10

He's polling it with some external service but you can get that data from Status > Monitoring:

Screenshot from 2025-05-06 15-34-36.png

shoulders

@stephenw10 Thanks for the heads up. I will monitor my pfsense and if it goes funny I will check ram usage etc...

zeroflow

@shoulders
In my setup, data is pushed via the Telegraf Plugin to an Influxdb time series DB. From there, I can create the visualizations in Grafana.

zeroflow

@stephenw10
I've now been able to test 2.8.0-BETA
(build date Mon Apr 28 1:42:00 CEST 2025)

For now, this seems to have fixed the issue.

New Screenshot

The dotted line is the installation of 2.8.0.

1 - Data from the original post.
2- Data after uninstalling plugins
3 - 2.8.0 Beta

The different form of spikes comes from the pfBlocker update. There is a new cron job at 3pm fetching some data.