I have upgraded OPNsense from 26.1.8 to 26.1.9 yesterday, the Unbound Reporting shows empty, Reset DNS data doesn't help, then I checked the Backend logs, it shows error:
2026-06-11T12:58:34Errorconfigd.py[200067b7-b4a7-4c0d-9581-d445d8562592] Script action failed with Command '/usr/local/opnsense/scripts/unbound/stats.py totals --max '10'' died with <Signals.SIGILL: 4>. at Traceback (most recent call last): File "/usr/local/opnsense/service/modules/actions/script_output.py", line 93, in execute subprocess.run(script_command, env=self.config_environment, shell=True, ~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ check=not self.disable_errors, stdout=output_stream, stderr=error_stream) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/usr/local/lib/python3.13/subprocess.py", line 577, in run raise CalledProcessError(retcode, process.args, output=stdout, stderr=stderr) subprocess.CalledProcessError: Command '/usr/local/opnsense/scripts/unbound/stats.py totals --max '10'' died with <Signals.SIGILL: 4>.and then I try to run stats.py on Console, it returns:
#/usr/local/opnsense/scripts/unbound/stats.py details --limit 1000
Illegal instruction
My hardware platform is Checkpoint 4600 with Pentium(R) Dual-Core CPU E6500 and 4G RAM.
Could be the switch to py-numpy 1.x -> 2.x. It would indicate your CPU is now too old to run it.
Cheers,
Franco
That's reason!
It seems that I can only disable the Unbound reporting for now.
Yes, sorry about that. The bright side of it was NumPy 2.0 is about 2 years old now and FreeBSD ports prolonged the life of 1.x for that long already.
Cheers,
Franco
I appreciate all work you have done on OPNsense.
I am attempting to send Unbound's logs to the syslog server.
Thanks again!
Apprently this made some waves looking at https://github.com/freebsd/freebsd-ports/commit/3c11b048c3d -- in theory we could flip it back but I'll have to discuss internally. The minimum optimization requirement was probably done for a good reason.
Cheers,
Franco
I'm glad to hear this.
It's a tough decision. After all, OPNSense focuses on security performance, and Unbound DNS reporting is just a plug-in functional component. However, many firewall platforms or all-in-one servers may not be equipped with the latest CPU, and I believe many users still require this functionality.
Thanks!
Quote from: franco on June 11, 2026, 08:27:17 AMApprently this made some waves looking at https://github.com/freebsd/freebsd-ports/commit/3c11b048c3d -- in theory we could flip it back but I'll have to discuss internally. The minimum optimization requirement was probably done for a good reason.
Quote from: wincent on June 11, 2026, 08:43:17 AMI'm glad to hear this.
It's a tough decision. After all, OPNSense focuses on security performance, and Unbound DNS reporting is just a plug-in functional component. However, many firewall platforms or all-in-one servers may not be equipped with the latest CPU, and I believe many users still require this functionality.
It was not exactly easy to find, but I guess you could check this : https://numpy.org/doc/stable/user/troubleshooting-importerror.html#segfaults-or-crashes
And compare it to this : https://www.techpowerup.com/cpu-specs/pentium-e6500.c864
Found via https://duckduckgo.com/?q=Pentium(R)+Dual-Core+CPU+E6500But if I am perfectly honest I can't really blame the guys for excluding such old CPU models : The days of Socket 775 are waaaay behind us now! :)
Looking at other software that had similar changes over the last 5 years or so I would recommand having at least something with AVX support for regular CPUs and I believe it was SSE4 for the Atom-like models.
Considering the horrible hardware prices situation we are currently in maybe you could look at used hardware that's in good condition as an upgrade option ?!
I still have 2 Clarkdale CPUs and motherboards kicking around here somewhere, if you wish to upgrade.
I have no idea if I can replace the Checkpoint equipment CPU manually.
I also have a brand new Checkpoint 4600(serving as a cold backup), and I can give it a try to upgrade its CPU.
Quote from: wincent on June 12, 2026, 03:33:39 AMI have no idea if I can replace the Checkpoint equipment CPU manually.
I also have a brand new Checkpoint 4600(serving as a cold backup), and I can give it a try to upgrade its CPU.
I think a lot of Intel Atom and ARM based AArch64 SoCs are waaaaay faster and consume less power by now :)
The CPU is soldered onto the motherboard, and for a customized motherboard with Checkpoint, the entire device can only be upgraded :(
Quote from: wincent on June 15, 2026, 04:23:15 AMThe CPU is soldered onto the motherboard, and for a customized motherboard with Checkpoint, the entire device can only be upgraded :(
I remembered something over the last couple of days :
Many years ago I have seen a CPU Review that contained something like this :
- Socket 775 CPU from the Quad Core Series.
I think it was the Q9550 or so...
- Pentium or Celeron CPU from the Gxxxx Series on one of the Z77/87/97 Chipsets.
This was only a Dual Core. Similar to something like the G1610 (https://www.intel.com/content/www/us/en/products/sku/71072/intel-celeron-processor-g1610-2m-cache-2-60-ghz/specifications.html) !!
And the Gxxxx CPU was faster most of the time :)
So I think you should really consider upgrading the whole thing instead of investing in very old hardware...
We don't have much budget. I remember this 4600 cost around $15,000, and now the new 3790 costs around almost $20,000.
I plan to replace it with a spare HP DL388, but there's a problem. The HP server takes too long to boot up, and the self-test takes several minutes, which is quite a headache.
For reference here is the relevant pull request on GitHub: https://github.com/numpy/numpy/pull/28896
The internal meeting is today. Just so you know I still owe you an answer here.
Cheers,
Franco
Quote from: wincent on June 16, 2026, 03:11:39 AMWe don't have much budget. I remember this 4600 cost around $15,000, and now the new 3790 costs around almost $20,000.
I plan to replace it with a spare HP DL388, but there's a problem. The HP server takes too long to boot up, and the self-test takes several minutes, which is quite a headache.
There is also a middle ground between spending $20,000 and wasting time and electricity with a DL388 just to run a firewall.
Official opnsense hardware :)
https://shop.opnsense.com/product/dec3940-opnsense-rack-security-appliance/
Why buy Checkpoint gear to run OPNsense in the first place?
Quote from: franco on June 16, 2026, 07:06:42 AMFor reference here is the relevant pull request on GitHub: https://github.com/numpy/numpy/pull/28896
The internal meeting is today. Just so you know I still owe you an answer here.
Cheers,
Franco
I am deeply grateful for your efforts.
Waiting for good news.
Quote from: Patrick M. Hausen on June 16, 2026, 09:23:10 AMWhy buy Checkpoint gear to run OPNsense in the first place?
We have been using it because this device can only be upgraded to Gaia 77.30 at most, while OPNsense keeps updating and allows users to customize the required functions(Base on FreeBSD). Therefore, I switched the system to OPNsense and it runs perfectly :)
Yes, but why even consider buying a new Checkpoint unit? There are many more affordable options for running OPNsense as @sopex already pointed out.
Currently, we have no plans to upgrade this device. If we were to upgrade, I probably wouldn't consider buying a Checkpoint to run OPNsense. As you mentioned, there are many options available.
Quote from: wincent on June 16, 2026, 10:56:56 AMIf we were to upgrade, I probably wouldn't consider buying a Checkpoint to run OPNsense. As you mentioned, there are many options available.
That's also what I meant and not what you seem to have thought in your previous post :
Quote from: wincent on June 16, 2026, 03:11:39 AMWe don't have much budget. I remember this 4600 cost around $15,000, and now the new 3790 costs around almost $20,000.
So this is a nice option too :
QuoteI plan to replace it with a spare HP DL388, but there's a problem. The HP server takes too long to boot up, and the self-test takes several minutes, which is quite a headache.
Too bad that it seems to be giving you issues... :(
HPE stuff usually has enough tools to check things so I hope you can find something and solve it without it giving you issues in the future :)
This is not an urgent matter, so anything can be tried. ^-^
Good morning,
Just adding a reply to track updates here, as I'm facing the same errors on my older rig running an AMD Phenom II 965 BE.
Thanks all.
So I guess this falls in the same category. I have Opnsense running in a ProxMox VM and has never been issue until the last update.
The underlying CPU is an Intel Celeron as I don't need OpnSense run a gazillion of sessions and has never had a performance problem. It would be very helpful if we could have this resolved. I know we're depending on an external set of libraries but it's a bit worrisome that parts of the product stop working due to "virtual" restrictions which haven't been a real problem before.
```
vendor_id : GenuineIntel
cpu family : 6
model : 156
model name : Intel(R) Celeron(R) N5105 @ 2.00GHz
```
Franco,
Are you able to share any updates here yet?
Thank you
I'm using OPNsense 26.7.7 with py313-numpy 2.4.6_1 on a system with an AMD Athlon 64 X2 5000+ (super old, but runs OPNsense great) and noticed this yesterday when I tried to enable Unbound logging.
Apparently this error happens because recent versions of NumPy are compiled to use features on newer hardware and the complied code chokes on older hardware. (Google: numpy illegal instruction) You can see the stack trace by running "python3 -v stats.py" I tracked the error to the following dynamic-link library:
/usr/local/lib/python3.13/site-packages/numpy/_core/_multiarray_umath.cpython-313.so
I worked around this by standing up a FreeBSD 15.1 VM (on my Linux Mint system), installing Python 3.13 and building NumPy for a generic system using the following command-line, and replacing the OPNsense ".so" above with the one generated (in the same location).
python3 -m pip install numpy==2.4.6 -Csetup-args=-Dcpu-baseline="none" -Csetup-args=-Dcpu-dispatch="none"
Unbound logging is working now on my system.
Obviously this is just a workaround for the current version of NumPy.
Hope this helps.
- Rick
The other workaround is not using ancient hardware. Don't feel comfortable pushing generic instructions in 2026 on everyone just because there is still some old hardware around that can't do basic optimizations.
Cheers,
Franco
Quote from: Rick on October 30, 2026, 07:52:33 AMAMD Athlon 64 X2 5000+ (super old, but runs OPNsense great)
Dude replace that power hungry beast with something like the Intel Atom N100 and be happy :)
IIRC everything newer than the S939 models up to the X2 4600+ was basically DOA because Intel had developed better CPU models in the meantime... Intel Conroe Generation I think...
My S939 X2 4400+ was fun, but I would not use it anymore unless it's for something like
"Retro Gaming" or whatever :)
Quote from: franco on October 30, 2026, 11:12:46 AMThe other workaround is not using ancient hardware. Don't feel comfortable pushing generic instructions in 2026 on everyone just because there is still some old hardware around that can't do basic optimizations.
I get that. :-) The system was what I had at the time my D-Link DSR-250 got hit with a severe CVE that D-Link flagged as "Won't fix", and it's generally "not broke", and uses commodity hardware, so I'm reluctant to replace it, for now anyway.
I don't know if is applicable, but I've read that the feature-set detection in NumPy can sometimes be incorrect on some hardware, especially AMD, which can cause the "illegal instruction" issue (see link below). An option might be to compile NumPy with OpenBlas support so the OPENBLAS_CORETYPE environment variable can be used to specify the specific platform. For example, "OPENBLAS_CORETYPE=Haswell". I don't think the stock FreeBSD 15 NumPy package has this enabled. I can't check that on my OPNsense system as NumPy crashes on import. :-) There are apparently other env-vars that can be set, like "NPY_DISABLE_CPU_FEATURES" (also mentioned below), but I haven't researched them.
NumPy Troubleshooting: Segfaults or crashes
https://numpy.org/doc/stable/user/troubleshooting-importerror.html#segfaults-or-crashes
I don't think any of that will help my system, but might help others.
- Rick
Quote from: nero355 on October 30, 2026, 08:54:49 PMQuote from: Rick on October 30, 2026, 07:52:33 AMAMD Athlon 64 X2 5000+ (super old, but runs OPNsense great)
Dude replace that power hungry beast with something like the Intel Atom N100 and be happy :)
When I was setting it up, I checked with a Kill-a-Watt meter and with PowerD set to Adaptive the system generally pulls around 30W which, according to a spreadsheet from my power company, adds about $3.00/month to my electric bill. I can live with that. :-) Using an SSD rather than HDD helps lower the power usage... As far as keeping up, isn't one of the talking points "just throw OPNsense on an old PC you have lying around"?
That said, I am looking into something newer, to mitigate any other issues that may arise from using a older system - from 2006 - but it's a testament to FreeBSD and OPNsense that they still work fine on a system this old, at least in a home setting. The NumPy thing is annoying, and I get their reasoning, but in this use case how much math acceleration does Unbound log graphing actually need, especially as the "generic" code I built runs fine on my ancient system?
Quote from: Rick on October 31, 2026, 01:31:21 AMisn't one of the talking points "just throw OPNsense on an old PC you have lying around"?
how much math acceleration does Unbound log graphing actually need, especially as the "generic" code I built runs fine on my ancient system?
The thing is that more and more regular software like a browser for example simply needs things like AVX/AVX2 and then there is simply no other choice but upgrading your hardware...
It's sad, but it is what it is :)
Quote from: Rick on October 30, 2026, 07:52:33 AMI'm using OPNsense 26.7.7 with py313-numpy 2.4.6_1 on a system with an AMD Athlon 64 X2 5000+ (super old, but runs OPNsense great) and noticed this yesterday when I tried to enable Unbound logging.
Apparently this error happens because recent versions of NumPy are compiled to use features on newer hardware and the complied code chokes on older hardware. (Google: numpy illegal instruction) You can see the stack trace by running "python3 -v stats.py" I tracked the error to the following dynamic-link library:
/usr/local/lib/python3.13/site-packages/numpy/_core/_multiarray_umath.cpython-313.so
I worked around this by standing up a FreeBSD 15.1 VM (on my Linux Mint system), installing Python 3.13 and building NumPy for a generic system using the following command-line, and replacing the OPNsense ".so" above with the one generated (in the same location).
python3 -m pip install numpy==2.4.6 -Csetup-args=-Dcpu-baseline="none" -Csetup-args=-Dcpu-dispatch="none"
Unbound logging is working now on my system.
Obviously this is just a workaround for the current version of NumPy.
Hope this helps.
- Rick
Great...!! Thank you, bro. I'll give it a try later :)
It works for me! The Unbound DNS Reporting is back. If you also have the same old platform and need to use the Unbound reporting function, you can also follow @Rick's method. Don't forget to lock the package when you're done.
pkg lock py313-numpy