Messages

[Hardware (all 4 units the same board)]

Hi all,

I run four OPNsense firewalls on identical hardware. During the major upgrade 26.1.11 -> 26.7, three of them froze at the very end of the upgrade. They stayed offline for hours until someone pulled the power plug. After a cold boot each one came up fine on 26.7 and has worked normally since. So the upgrade itself completed; only the final automatic reboot failed.

Hardware (all 4 units the same board)

• Unbranded mini-PC board, SMBIOS shows "Default string" everywhere
• AMI BIOS 5.27, dated 03/27/2025, newest available version
• Intel B660 chipset
• CPU: 3x Intel Core i3-14100 (8 GB RAM), 1x Intel Core i7-14700 (32 GB RAM)
• NICs: Intel I226-V (igc) + Intel 10G SFP+ (ix)
• UEFI boot, ZFS root
• os-cpu-microcode-intel is NOT installed on any of them (I know about the "masks" hang thread; it doesn't apply here)

What happened

• Unit A (i7): upgraded 2026-10-06 (26.1.11 -> 26.7.7), froze. Back after a power cycle.
• Unit B (i3): upgraded 2026-10-06 (26.1.11 -> 26.7.7), froze. Back after a power cycle.
• Unit C (i3): upgraded 2026-10-29 (26.1.11 -> 26.7.7), no problem; rebooted on its own and came back.
• Unit D (i3): upgraded 2026-11-03 (26.1.11 -> 26.7.7), froze. Back after a power cycle.

Every normal reboot, including minor updates (e.g. 26.7.7 -> 26.7.8_2), works fine on all four units. The problem only shows up on the major upgrade.

Where it stops
The first reboot into the new kernel works. The box then boots the post-upgrade stage (hostname "localhost"), which upgrades the packages and runs the config migrations successfully. On the unit that worked, the log ends with "rebooted by root", and it is back within about 50 seconds. On the units that froze, nothing more is logged. The last lines on unit A, B and D were:

Code Select Expand

2026-11-03T19:00:11 localhost kernel: Configuring system logging...done.
2026-11-03T19:00:11 localhost kernel: ==> Running trigger: glib-schemas.ucl
2026-11-03T19:00:11 localhost kernel: Compiling glib schemas
2026-11-03T19:00:11 localhost kernel: No schema files found: doing nothing.
2026-11-03T19:00:11 localhost kernel: ==> Running trigger: gio-modules.ucl
2026-11-03T19:00:11 localhost kernel: Generating GIO modules cache
(nothing until the power cycle, even after I waited for 6 hours)

So the freeze happens within seconds of the end of the post-upgrade stage, either just before or during the automatic reboot. These units are remote, so I don't have console output yet. Next time I will connect a monitor.

Questions

• Has anyone seen this on similar boards (CWWK/Topton-style, B660 + I226-V + SFP+)?
• Does the post-upgrade stage reboot differently from a normal "reboot", e.g. while some drivers or services are only partly initialised?
• Are there tunables worth trying (e.g. hw.efi.poweroff, USB shutdown settings), or debug options that would capture more output before the next major upgrade?

Possibly related thread: https://forum.opnsense.org/index.php?topic=52391.0

Thanks!

Thanks, that was the correct hint to find the needed steps!

Here are the required steps:

- Enabling archiving
- Visualizing the events on the dashboard
- Wazuh dashboard

Hello,

I'm new to Wazuh and installed it a few days ago. I see some logs from OPNsense in Wazuh but the logs from the filter are missing. I followed the instructions at https://docs.opnsense.org/manual/wazuh-agent.html but unfortunately they did not help me.

On OPNsense under "Services -> Wazuh Agent -> Settings -> Applications" I also selected filter (filterlog) and firewall (firewall).

Is there anything else needed to get the filter logs into Wazuh?

Hello,

I created a new plugin OPNarplog for OPNsense and created a PR on GitHub (https://github.com/opnsense/plugins/pull/4322). Someone knows how long it usually takes to get a PR merged?

Do I need to do anything else to get it merged? I opened it in October 2024, so some months already passed, but there is no sign, that it will be merged at all.

Had the same issue and found this post on Google. Then I found and issue on GitHub: https://github.com/opnsense/core/issues/5752

You need to select a host override to see it's aliases in the list below.