I have upgraded OPNsense from 26.1.8 to 26.1.9 yesterday, the Unbound Reporting shows empty, Reset DNS data doesn't help, then I checked the Backend logs, it shows error:
2026-06-11T12:58:34Errorconfigd.py[200067b7-b4a7-4c0d-9581-d445d8562592] Script action failed with Command '/usr/local/opnsense/scripts/unbound/stats.py totals --max '10'' died with <Signals.SIGILL: 4>. at Traceback (most recent call last): File "/usr/local/opnsense/service/modules/actions/script_output.py", line 93, in execute subprocess.run(script_command, env=self.config_environment, shell=True, ~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ check=not self.disable_errors, stdout=output_stream, stderr=error_stream) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/usr/local/lib/python3.13/subprocess.py", line 577, in run raise CalledProcessError(retcode, process.args, output=stdout, stderr=stderr) subprocess.CalledProcessError: Command '/usr/local/opnsense/scripts/unbound/stats.py totals --max '10'' died with <Signals.SIGILL: 4>.and then I try to run stats.py on Console, it returns:
#/usr/local/opnsense/scripts/unbound/stats.py details --limit 1000
Illegal instruction
My hardware platform is Checkpoint 4600 with Pentium(R) Dual-Core CPU E6500 and 4G RAM.
Could be the switch to py-numpy 1.x -> 2.x. It would indicate your CPU is now too old to run it.
Cheers,
Franco
That's reason!
It seems that I can only disable the Unbound reporting for now.
Yes, sorry about that. The bright side of it was NumPy 2.0 is about 2 years old now and FreeBSD ports prolonged the life of 1.x for that long already.
Cheers,
Franco
I appreciate all work you have done on OPNsense.
I am attempting to send Unbound's logs to the syslog server.
Thanks again!
Apprently this made some waves looking at https://github.com/freebsd/freebsd-ports/commit/3c11b048c3d -- in theory we could flip it back but I'll have to discuss internally. The minimum optimization requirement was probably done for a good reason.
Cheers,
Franco
I'm glad to hear this.
It's a tough decision. After all, OPNSense focuses on security performance, and Unbound DNS reporting is just a plug-in functional component. However, many firewall platforms or all-in-one servers may not be equipped with the latest CPU, and I believe many users still require this functionality.
Thanks!
Quote from: franco on June 11, 2026, 08:27:17 AMApprently this made some waves looking at https://github.com/freebsd/freebsd-ports/commit/3c11b048c3d -- in theory we could flip it back but I'll have to discuss internally. The minimum optimization requirement was probably done for a good reason.
Quote from: wincent on June 11, 2026, 08:43:17 AMI'm glad to hear this.
It's a tough decision. After all, OPNSense focuses on security performance, and Unbound DNS reporting is just a plug-in functional component. However, many firewall platforms or all-in-one servers may not be equipped with the latest CPU, and I believe many users still require this functionality.
It was not exactly easy to find, but I guess you could check this : https://numpy.org/doc/stable/user/troubleshooting-importerror.html#segfaults-or-crashes
And compare it to this : https://www.techpowerup.com/cpu-specs/pentium-e6500.c864
Found via https://duckduckgo.com/?q=Pentium(R)+Dual-Core+CPU+E6500But if I am perfectly honest I can't really blame the guys for excluding such old CPU models : The days of Socket 775 are waaaay behind us now! :)
Looking at other software that had similar changes over the last 5 years or so I would recommand having at least something with AVX support for regular CPUs and I believe it was SSE4 for the Atom-like models.
Considering the horrible hardware prices situation we are currently in maybe you could look at used hardware that's in good condition as an upgrade option ?!
I still have 2 Clarkdale CPUs and motherboards kicking around here somewhere, if you wish to upgrade.
I have no idea if I can replace the Checkpoint equipment CPU manually.
I also have a brand new Checkpoint 4600(serving as a cold backup), and I can give it a try to upgrade its CPU.
Quote from: wincent on June 12, 2026, 03:33:39 AMI have no idea if I can replace the Checkpoint equipment CPU manually.
I also have a brand new Checkpoint 4600(serving as a cold backup), and I can give it a try to upgrade its CPU.
I think a lot of Intel Atom and ARM based AArch64 SoCs are waaaaay faster and consume less power by now :)
The CPU is soldered onto the motherboard, and for a customized motherboard with Checkpoint, the entire device can only be upgraded :(
Quote from: wincent on June 15, 2026, 04:23:15 AMThe CPU is soldered onto the motherboard, and for a customized motherboard with Checkpoint, the entire device can only be upgraded :(
I remembered something over the last couple of days :
Many years ago I have seen a CPU Review that contained something like this :
- Socket 775 CPU from the Quad Core Series.
I think it was the Q9550 or so...
- Pentium or Celeron CPU from the Gxxxx Series on one of the Z77/87/97 Chipsets.
This was only a Dual Core. Similar to something like the G1610 (https://www.intel.com/content/www/us/en/products/sku/71072/intel-celeron-processor-g1610-2m-cache-2-60-ghz/specifications.html) !!
And the Gxxxx CPU was faster most of the time :)
So I think you should really consider upgrading the whole thing instead of investing in very old hardware...
We don't have much budget. I remember this 4600 cost around $15,000, and now the new 3790 costs around almost $20,000.
I plan to replace it with a spare HP DL388, but there's a problem. The HP server takes too long to boot up, and the self-test takes several minutes, which is quite a headache.
For reference here is the relevant pull request on GitHub: https://github.com/numpy/numpy/pull/28896
The internal meeting is today. Just so you know I still owe you an answer here.
Cheers,
Franco
Quote from: wincent on June 16, 2026, 03:11:39 AMWe don't have much budget. I remember this 4600 cost around $15,000, and now the new 3790 costs around almost $20,000.
I plan to replace it with a spare HP DL388, but there's a problem. The HP server takes too long to boot up, and the self-test takes several minutes, which is quite a headache.
There is also a middle ground between spending $20,000 and wasting time and electricity with a DL388 just to run a firewall.
Official opnsense hardware :)
https://shop.opnsense.com/product/dec3940-opnsense-rack-security-appliance/
Why buy Checkpoint gear to run OPNsense in the first place?
Quote from: franco on June 16, 2026, 07:06:42 AMFor reference here is the relevant pull request on GitHub: https://github.com/numpy/numpy/pull/28896
The internal meeting is today. Just so you know I still owe you an answer here.
Cheers,
Franco
I am deeply grateful for your efforts.
Waiting for good news.
Quote from: Patrick M. Hausen on June 16, 2026, 09:23:10 AMWhy buy Checkpoint gear to run OPNsense in the first place?
We have been using it because this device can only be upgraded to Gaia 77.30 at most, while OPNsense keeps updating and allows users to customize the required functions(Base on FreeBSD). Therefore, I switched the system to OPNsense and it runs perfectly :)
Yes, but why even consider buying a new Checkpoint unit? There are many more affordable options for running OPNsense as @sopex already pointed out.
Currently, we have no plans to upgrade this device. If we were to upgrade, I probably wouldn't consider buying a Checkpoint to run OPNsense. As you mentioned, there are many options available.
Quote from: wincent on June 16, 2026, 10:56:56 AMIf we were to upgrade, I probably wouldn't consider buying a Checkpoint to run OPNsense. As you mentioned, there are many options available.
That's also what I meant and not what you seem to have thought in your previous post :
Quote from: wincent on June 16, 2026, 03:11:39 AMWe don't have much budget. I remember this 4600 cost around $15,000, and now the new 3790 costs around almost $20,000.
So this is a nice option too :
QuoteI plan to replace it with a spare HP DL388, but there's a problem. The HP server takes too long to boot up, and the self-test takes several minutes, which is quite a headache.
Too bad that it seems to be giving you issues... :(
HPE stuff usually has enough tools to check things so I hope you can find something and solve it without it giving you issues in the future :)
This is not an urgent matter, so anything can be tried. ^-^
Good morning,
Just adding a reply to track updates here, as I'm facing the same errors on my older rig running an AMD Phenom II 965 BE.
Thanks all.
So I guess this falls in the same category. I have Opnsense running in a ProxMox VM and has never been issue until the last update.
The underlying CPU is an Intel Celeron as I don't need OpnSense run a gazillion of sessions and has never had a performance problem. It would be very helpful if we could have this resolved. I know we're depending on an external set of libraries but it's a bit worrisome that parts of the product stop working due to "virtual" restrictions which haven't been a real problem before.
```
vendor_id : GenuineIntel
cpu family : 6
model : 156
model name : Intel(R) Celeron(R) N5105 @ 2.00GHz
```