Help problam with pfsense work slow
-
??? ??? ??? ???
I have a problem with pfsense
Or is it a problem with the computer which pfsense installed onOn pfsense
Three packages are installed
snort
squid
havpEverything worked great until two days ago
I made no changeThe only thing I did was reboot the system
As you can see in the picture
The memory usage
And swap usage
Very highAgain everything worked great with packages without any problems
But somehow it all works very slowly now
Web page takes maybe three minutes be loadedWhat could be the problem
And how can I fix it
-
If the machine starts using swap for regular stuff (rather than only when updating Snort for example) then you need more RAM. Swap is slow. How much RAM do you have?
Steve
-
768 mega
But it worked until now Excellent
The same amount of memory
What has changed?
snort is installed less than a month
Everything worked properly for about 3 weeks, maybe a little more
Until two days ago -
You shouldn't be running snort on that. Its just not up to it with ram and probably processor either.
-
It does not make sense
It worked fine until I reboot the system
Could it be a problem in one of the components of the computer ?
-
Possible… But not likely.
If you go to diagnostics > command prompt and type this in, what do you get?
sysctl hw.physmem
-
Yep, I would guess Snort used all your RAM and the machine started swapping continuously. Possibly it downloaded a new rule set. If you tune Snort sufficiently it can run in low memory systems but you have to be careful. Can you add more RAM?
Steve
-
Possible… But not likely.
If you go to diagnostics > command prompt and type this in, what do you get?
sysctl hw.physmem
$ sysctl hw.physmem
hw.physmem: 774799360Yep, I would guess Snort used all your RAM and the machine started swapping continuously. Possibly it downloaded a new rule set. If you tune Snort sufficiently it can run in low memory systems but you have to be careful. Can you add more RAM?
Steve
The board has three Memory slots
And all of them are occupiedI'll try to find memories with larger bulk
-
Basically, I asked you to check that so I could see if some of your ram had failed, but its all there.
99 times out of 100 bad ram or bad ram slot will just cause panics and reboots and BSODs. But I've had one time before where a stick just went bye-bye and the thing kept working perfectly just showing less ram.
So, like he said - either trim the memory usage or ditch the memory hogs. Swapping is BAD.
-
Thanks for the answers
I will try to get a larger volume memoriesJust out of curiosity
How much memory is needed for the system to work well with these packagesAnother question
I turned off the snort
The swap usage dropped to 2 percent
And Memory usage dropped between 50 and 70 percentI think like that stephenw10 said here is related to an update of the snort rules
How can I configure the snort not use a lot of memory
Or at least work like two days agoThanks again to everyone
-
Have a look though the forum for running Snort on an Alix board. It's not really recommended, because the Alix has only 256MB and no swap at all, but people have done it. If they can, you can.
At the very least set the performance to 'lowmem' and try to minimise the rule sets you're using.
Steve
-
I did what you said
There are several modes to use memory
For me it was set to AC-STD
I changed it to LOWMEMSo far, so good
Thanks