Every time i start zenarmor engine, my system is unusable because de CPU goes to 100% usage. Zenarmor is configure to don't start at boot so when this happens i reboot the computer to make it accessible again. I have a protectli VP2420 with 16 gig of ram. Everything was working fine before that.
I don't know why this is happening. Anyone in the same situation ?
Hello,
What deployment you are using, driver, interfaces, DB, etc. ?
Did you check top output?
If its ZA doing this,
Best to contact ZA support directly via a ticket using the UI.
Regards,
S.
Protectli VP2420 with 16 GB of RAM ......
Intel Celeron J6412
* Quad Core
* 1,5 MB L2-Cache
* 2,0 GHz with burst till 2,6 GHz
* Intel AES-NI hardware acceleration
is really fast enough.
A mismatch with suricata on the same interface ?
100% is in top viewed on cli?
And which are the processes using the whole cpu cores ?
Zenarmor free edition can only use 1 cpu core.
Hi all,
I had a similar issue on a N5105 box with 4x I226-V (igc) and Zenarmor enabled.
On 27–28 Sep the firewall froze completely (no SSH, no web UI, no ping) and required a hard reboot.
System logs showed repeated netmap TX stalls on LAN:
<13>1 2026-09-27T21:30:39+02:00 OPNsense kernel - netmap_transmit igcx full hwcur 515 hwtail 515 qlen 1023
<13>1 2026-09-28T01:21:37+02:00 OPNsense kernel - netmap_transmit igcx full hwcur 515 hwtail 515 qlen 1023
Note: "mekano" hasn't posted any logs.
From their description, their issue looks more like memory exhaustion (Elasticsearch + Zenarmor) than an igc/netmap driver stall like in my case.
HW/SW: N5105, 4x I226-V, OPNsense 26.7.4_1, Zenarmor enabled on multiple VLANs, Suricata disabled.
What fixed it:
- Tunables:
net.inet.tcp.tso = 0
dev.igc.x.lro = 0
dev.igc.x.lro = 0
dev.igc.x.lro = 0
dev.igc.x.lro = 0
dev.igc.x.eee_control = 0
dev.igc.x.eee_control = 0
dev.igc.x.eee_control = 0
dev.igc.x.eee_control = 0
hw.pci.enable_aspm = 0
vfs.zfs.arc_max = 3221225472
After reboot: no more "netmap_transmit igcx full" messages, igcx shows 1000baseT full-duplex, system and Zenarmor are stable.
I'm still monitoring to confirm long-term stability..
I've opened a Zenarmor ticket with logs and tunables, but for me the problem is already fixed.
If anyone else is hitting netmap TX stalls on I226-V with Zenarmor, these tunables plus forcing 1G full-duplex have worked for me so far.