Messages

this isn't an known issue. Either configuration problem, hardware problem or both.
You won't have answers without expressing your setup, hardware, etc. All you would expect anyone bringing to you to diagnose a problem with something you are familiar with.

I couldn't find the conversation on this forum in my mind.
So in the meantime I'll still suggest either testing the available api or do this unix-to-human change/append to the file, either before sending or at the destination. Sure both have pros and cons.

It would be for anyone. You're not wrong.
The system is unix-like so it has a date function. If you type "date" without the quotes, it'll present the human-readable date and time.
You could write some script to append it or something like that.
Let me see if I can find the previous conversation on this forum about it.
p.s. the download will also have a human timestamp of the downloaded file on the receiving system, which could also be useful.

I'm not sure this is a case where the rule should be using direction OUT.
Can you try this rule but direction IN, and have a ready-made pass for where the traffic will flow into the firewall. It seems for first post you are sending it to loopback so I expect not needed but I might not see the whole picture.

but why limit your investigation to that metric only?
Unless I misread the whole thing you have a firewall that has an apparent overuse of cpu cycles. You are trying to investigate what _process_ might be the one(s) causing the spike in cpu cycles. Here is what my suggestion is, to use htop to see what processes are using up the cpus. From that you can hopefully identify the processes and start digging into them to figure out why.
A ps no matter what flags to use is only a point-in-time list of processes. top/htop are updating real time unless the whole machine is too overwhlemed.

Just need to figure out what is the actual problem. use your browser's developer tools to see what is the actual error if there is one.

It sounds like it's configuration problem.
When you go from VM to baremetal or viceversa, there are changes to be made. There is no proxmox bridge anymore, the firewall rules will need to be adjusted for instance.
Either will work fine on small networks until you need high cpu performance for IPS for instance.
My main OPN (at home) runs as VM on a small Chanwang thingie and has spare resources. It uses an AMD Ryzen 5 5600U with just 2 cores, 2 threads. Uses various services, including Zenarmor, a few VLANs. No problem.
In sum, just review or post your settings and we'll help you figure out the problem. Doubt is performance related.

You can just invoke "top" and sort by CPU. FreeBSD top can do that. And lots of other things.

True, just preferences. I find htop better shows me the process tree and colours. Just personal preferences.

Could you install htop, launch with admin privs and sort by CPU ? May show a clue

You can just invoke "top" and sort by CPU. FreeBSD top can do that. And lots of other things.

done in the other thread i link, the top shows a 100% usage in the interrupt level specially in the netisr irq handler, see the picture:
https://forum.opnsense.org/index.php?action=dlattach;attach=56143

Sure but I'm referring to htop allows to see the process tree in real time which is of more interest.

thanks for the insight @Patrick M Hausen

Could you install htop, launch with admin privs and sort by CPU ? May show a clue

Wrong domain? It comes from your settings: System | Settings | General
So you need to set the correct domain there and the config will adapt. As for the unix timestamp I'm sure there was a discussion about it before on the forum. It must habe been agreed to leave for a reason. Of course finding the conversion from unix epoch is easy but we all know that.

From https://forum.opnsense.org/index.php?topic=52223.msg269736;topicseen#msg269736 and initially for @philippe_crowdsec

Thank you first of all for allowing to reach you with these product questions.
As I wrote there, I was enthusiastic at the beginning with Crowdsec when you came on this forum to request early users and feedback for it. I went on to install the Crowdsec plugin and moved to a distributed setup where OPN runs the LAPI and expose it to other servers. So far so good.
What disappointed me since then in I think was 2022 was the lack of inclusion of the developments in Crowdsec into this OPN plugin. It can still only install os-crowdsec, the plugin itself, crowdsec and the crowdsec-firewall-bouncer.
So it can "only" list the hub plugins (parsers, scenarios..) and decisions on the OPNsense admin interface but not manage them. Not add them, modify or remove them. The opnsense-generic collection is at version 0.5 on the hub. Version 0.2 for brute force protection. Tells a lot, like it was done and then left. No more collections are available for it. The history in github tells us it was created in 2022, updated once in 2023 and a bit of a generic spruce up this year for labels, tags and such like.

One of the main difficulties in integrating is with other OPN plugins. For example if I run the haproxy plugin (which I do), then the parsing of its log file mainly reports failures to parse. Whether it is because is not vanilla haproxy or freebsd logging I don't know but I had a hard time last time to get your people's attention to this on discord https://discord.com/channels/921520481163673640/1296828602398015540/threads/1342642325226000404 where my continuous attempts were categorised at spam.

Maybe you can begin to see my point. Initial setup of plugin fine but seems almost abandoned since. Interactions in a medium like Discord is hard for a technical issue, and then "staff" were less than helpful.

So, although I don't want it to be a complaintfest, I wanted to provide the context and difficulties.
What do I want from the thread?
A view on what can we expect as improvements to the OPNSense experience of using Crowdsec. Right now it feels we are providing signals and in return a mostly IDS. I'd like to have it explained how to get to use IDP for instance leveraging WAF for haproxy using the plugin.
And does anybody else feel they're using it better than the defaults. How ?

Thank you for reading so far.

p.s. I also contributed this https://forum.opnsense.org/index.php?topic=44839.0 but now I'd love to use SPOA instead but that is not possible due to https://github.com/opnsense/plugins/issues/4923

I suppose this is now answered with more detail here https://forum.opnsense.org/index.php?topic=52307.msg269775;boardseen#new so no need to repeat.

CPU bottlenecked by storage subsystem perhaps, trying to log.

Very good.