1
23.1 Legacy Series / Surricata causing 100% CPU load after upgrade on 23.1
« on: February 05, 2023, 10:59:15 am »
Hello,
just did the update from latest 22.7 to 23.1 and was wondering about WAN gateways showing offline and then I spotted 100% load on CPU caused by unbound and surricata.
Restarting unbound did not help but disabling surricata solves the issue immediately.
If then surricata is enabled again it seems like working but maybe after 10-30s CPU goes up again. currently 100% reproducable.
OPNSens 23.1_6 amd
os-etpro-telemetry (installed) 1.6_1
Any tipp how to troubleshoot?
Note: this is on my backup OPNsense with currently no traffic. Live 5-10% surricata was normal but not 100% and causing unbound to go crazy as well.
surricata enabled:
normal load surricate disabled:
try without any ids rules enabled - still 100% but less on unbound:
just did the update from latest 22.7 to 23.1 and was wondering about WAN gateways showing offline and then I spotted 100% load on CPU caused by unbound and surricata.
Restarting unbound did not help but disabling surricata solves the issue immediately.
If then surricata is enabled again it seems like working but maybe after 10-30s CPU goes up again. currently 100% reproducable.
OPNSens 23.1_6 amd
os-etpro-telemetry (installed) 1.6_1
Any tipp how to troubleshoot?
Note: this is on my backup OPNsense with currently no traffic. Live 5-10% surricata was normal but not 100% and causing unbound to go crazy as well.
surricata enabled:
Code: [Select]
PID USERNAME THR PRI NICE SIZE RES STATE C TIME WCPU COMMAND
15989 unbound 4 52 0 91M 53M kqread 2 1:01 198.03% unbound
31733 root 9 20 0 3093M 341M nanslp 2 0:40 86.33% suricata
normal load surricate disabled:
Code: [Select]
PID USERNAME THR PRI NICE SIZE RES STATE C TIME WCPU COMMAND
80557 root 1 23 0 60M 33M select 1 0:00 0.74% php-cgi
47553 root 1 20 0 57M 37M accept 3 0:01 0.32% php-cgi
273 root 2 52 0 109M 62M accept 3 0:17 0.20% python3.9
try without any ids rules enabled - still 100% but less on unbound:
Code: [Select]
PID USERNAME THR PRI NICE SIZE RES STATE C TIME WCPU COMMAND
70580 unbound 2 21 0 91M 54M uwait 1 1:43 99.97% unbound
79961 root 9 20 0 2821M 100M nanslp 3 1:39 95.72% suricata
32905 root 1 20 0 14M 4220K CPU0 0 0:01 0.02% top