2.1.3 Randomly dies

kejianshi

Failing drive?

heper

i'd also say its related to a failing harddrive

stephenw10

He's running Nano on a CF card so it would be unusual to see a failure, but not unheard of. ;)
Is this a new CF card? Does the system mark the filesystem as dirty when you reboot? Does it find and fix problems?
Trying another card is the first thing I'd do.

Steve

kejianshi

I know - But I see a error with writing and I think "Check for disk error".

Could be out of memory also I suppose?

Supermule

Running out of space on the harddrive?

stephenw10

I'm not arguing that it isn't a bad drive (card) just pointing out why it might not be that.
Out of space is a good call. What Nano image size are you using? Are you using huge Snort lists? ;)

Steve

chamele0n

I am using a 4GB CF card with the 4GB pfSense image. As for Snort I only using Community rules with ET Open rules, and have IPS Policy set to Balanced.

It was running fine for about a month or 2, but has since started to fail. I suppose to CF Card could be filling up.

I ran a df and it looks like it might be filling up? I'm not entirely linux savvy (on and off for several years but never as a primary OS)

Attached is a screenshot of the output.

![Screen Shot 2014-09-15 at 12.36.46 PM.png](/public/imported_attachments/1/Screen Shot 2014-09-15 at 12.36.46 PM.png)
![Screen Shot 2014-09-15 at 12.36.46 PM.png_thumb](/public/imported_attachments/1/Screen Shot 2014-09-15 at 12.36.46 PM.png_thumb)

bmeeks

@chamele0n:

I am using a 4GB CF card with the 4GB pfSense image. As for Snort I only using Community rules with ET Open rules, and have IPS Policy set to Balanced.

It was running fine for about a month or 2, but has since started to fail. I suppose to CF Card could be filling up.

I ran a df and it looks like it might be filling up? I'm not entirely linux savvy (on and off for several years but never as a primary OS)

Attached is a screenshot of the output.

The current Snort package does a poor job of managing its log file growth. For conventional hard disk installs this is not much of an issue, but for CF installs it gets to be a bigger deal. I'm working on an update now for Snort that will bring all the Log Management features into Snort that are now in Suricata. These include enforced log limit sizes and retention periods for rotated logs. This will help out CF installs where space in /var is at a premium. I hope to be posting the update for review by the pfSense team later this week or early next week.

Bill

stephenw10

Looks like you have plenty of space left currently. Check it again after a few days.
I would still suspect the card might be failing.

Steve

chamele0n

I ended up formatting the CF Card and reinstalling 2.1.5 fresh and only restoring certain sets of the config that I absolutely needed (firewall rules, aliases and such) and then I reconfigured DHCP and Snort manually. It seems to be running smooth for the last couple days, but I may shut it down and dd the CF card for a good bare-metal backup and still order a new CF card (or made a HDD??? so many choices!!)