Help problam with pfsense work slow



  • ??? ??? ??? ???

    I have a problem with pfsense
    Or is it a problem with the computer which pfsense installed on

    On pfsense
    Three packages are installed
    snort
    squid
    havp

    Everything worked great until two days ago
    I made no change

    The only thing I did was reboot the system

    As you can see in the picture
    The memory usage
    And swap usage
    Very high

    Again everything worked great with packages without any problems
    But somehow it all works very slowly now
    Web page takes maybe three minutes be loaded

    What could be the problem
    And how can I fix it



  • Netgate Administrator

    If the machine starts using swap for regular stuff (rather than only when updating Snort for example) then you need more RAM. Swap is slow. How much RAM do you have?

    Steve



  • 768 mega

    But it worked until now Excellent

    The same amount of memory

    What has changed?

    snort is installed less than a month
    Everything worked properly for about 3 weeks, maybe a little more
    Until two days ago



  • You shouldn't be running snort on that.  Its just not up to it with ram and probably processor either.



  • It does not make sense

    It worked fine until I reboot the system

    Could it be a problem in one of the components of the computer ?



  • Possible…  But not likely.

    If you go to diagnostics > command prompt and type this in, what do you get?

    sysctl hw.physmem


  • Netgate Administrator

    Yep, I would guess Snort used all your RAM and the machine started swapping continuously. Possibly it downloaded a new rule set. If you tune Snort sufficiently it can run in low memory systems but you have to be careful. Can you add more RAM?

    Steve



  • @kejianshi:

    Possible…  But not likely.

    If you go to diagnostics > command prompt and type this in, what do you get?

    sysctl hw.physmem

    $  sysctl hw.physmem
    hw.physmem: 774799360

    @stephenw10:

    Yep, I would guess Snort used all your RAM and the machine started swapping continuously. Possibly it downloaded a new rule set. If you tune Snort sufficiently it can run in low memory systems but you have to be careful. Can you add more RAM?

    Steve

    The board has three Memory slots
    And all of them are occupied

    I'll try to find memories with larger bulk



  • Basically, I asked you to check that so I could see if some of your ram had failed, but its all there.

    99 times out of 100 bad ram or bad ram slot will just cause panics and reboots and BSODs.  But I've had one time before where a stick just went bye-bye and the thing kept working perfectly just showing less ram.

    So, like he said - either trim the memory usage or ditch the memory hogs.  Swapping is BAD.



  • Thanks for the answers
    I will try to get a larger volume memories

    Just out of curiosity
    How much memory is needed for the system to work well with these packages

    Another question
    I turned off the snort
    The swap usage dropped to 2 percent
    And Memory usage dropped between 50 and 70 percent

    I think like that stephenw10 said here is related to an update of the snort rules

    How can I configure the snort not use a lot of memory
    Or at least work like two days ago

    Thanks again to everyone


  • Netgate Administrator

    Have a look though the forum for running Snort on an Alix board. It's not really recommended, because the Alix has only 256MB and no swap at all, but people have done it. If they can, you can.

    At the very least set the performance to 'lowmem' and try to minimise the rule sets you're using.

    Steve



  • I did what you said
    There are several modes to use memory
    For me it was set to AC-STD
    I changed it to LOWMEM

    So far, so good

    Thanks


Log in to reply