After updating my firewall to OPNsense 26.7, I've noticed that the CrowdSec plugin appears to be using significantly more CPU (upwards of 100%) than it did before the update.
Has anyone else experienced this after upgrading, or is this a known issue with 26.7?
For reference, here's some information about my system:
OPNsense version:
OPNsense 26.7 (amd64)
CrowdSec version:
version: v1.7.8_1-6322745
Codename: alphaga
BuildDate: 2026-07-06_18:59:29
GoVersion: 1.26.4
Platform: freebsd
libre2: C++
User-Agent: crowdsec/v1.7.8_1-6322745-freebsd
Constraint_parser: >= 1.0, <= 3.0
Constraint_scenario: >= 1.0, <= 3.0
Constraint_api: v1
Constraint_acquis: >= 1.0, < 2.0
Built-in optional components: datasource_appsec, datasource_cloudwatch, datasource_docker, datasource_file, datasource_http, datasource_journalctl, datasource_k8s-audit, datasource_kafka, datasource_kinesis, datasource_loki, datasource_s3, datasource_syslog, datasource_victorialogs, datasource_wineventlog, db_mysql, db_postgres, db_sqlite
Excluded components: cscli_setup
Hardware:
hw.model: Intel(R) N200
If there are any additional logs or diagnostics that would be helpful, please let me know, and I'd be happy to provide them.
Thanks! |
I use the same version of CrowdSec and it still works the same as in 26.1... I don't have any more CPU usage. I think since I updated to 26.7 I have less CPU usage overall. It works very, very well. 👌
crowdsec -version
version: v1.7.8_1-6322745
Codename: alphaga
BuildDate: 2026-07-06_18:59:29
GoVersion: 1.26.4
Platform: freebsd
libre2: C++
User-Agent: crowdsec/v1.7.8_1-6322745-freebsd
Constraint_parser: >= 1.0, <= 3.0
Constraint_scenario: >= 1.0, <= 3.0
Constraint_api: v1
Constraint_acquis: >= 1.0, < 2.0
Built-in optional components: datasource_appsec, datasource_cloudwatch, datasource_docker, datasource_file, datasource_http, datasource_journalctl, datasource_k8s-audit, datasource_kafka, datasource_kinesis, datasource_loki, datasource_s3, datasource_syslog, datasource_victorialogs, datasource_wineventlog, db_mysql, db_postgres, db_sqlite
Excluded components: cscli_setup
(https://i.imgur.com/Te7nFip.png)
Quote from: josephistired on July 21, 2026, 06:09:46 AMIf there are any additional logs or diagnostics that would be helpful, please let me know, and I'd be happy to provide them.
You could have added your
top output to the opening post ;)
I should've added the top output, my bad.
last pid: 73859; load averages: 3.17, 2.90, 2.81 up 23+00:00:57 20:57:58
77 processes: 2 running, 75 sleeping
CPU: 0.0% user, 0.0% nice, 4.3% system, 0.0% interrupt, 95.7% idle
Mem: 403M Active, 728M Inact, 13G Wired, 497M Buf, 12G Free
ARC: 10G Total, 3148M MFU, 6877M MRU, 380K Anon, 56M Header, 161M Other
7965M Compressed, 13G Uncompressed, 1.67:1 Ratio
Swap: 2048M Total, 2048M Free
PID USERNAME PRI NICE SIZE RES STATE C TIME WCPU COMMAND
21006 root 20 0 1189M 206M CPU0 0 44:28 297.18% crowdsec
23548 root 20 0 2884M 91M CPU2 2 4:58 4.74% python3.11
19907 root 20 0 454M 101M CPU1 1 26:22 0.34% suricata
...