Messages

Good catch depnding on config hot to tough may totally be within specification. Even the power regulators for your CPU are rated far above what you can physically touch. That doesn't rule out it might be a contributing factor but if it works in another system then thats a good indication its not the issue.

Can you perhaps try the card in a bench machine or another desktop system with that 90º riser card? its possible there is a damaged trace of the riser is simply faulty (fails continuity).

Otherwise I would be interested in memtest results. and a bios reset. which a flash should do for you depending on board. so that we may be able to scratch off power saving/other features from interrupting the bus in an odd way.

Hi! Thank you for the response!

When I run

Code Select Expand

clog /var/log/system.log | grep "update IDS rules"

I get no response from the terminal.

When I run

Code Select Expand

cat /var/cron/tabs/root

I get the output of the current settings in the IDS schedule page. They seem correct.

The manual updating of the IDS definitions works perfectly and immediately.

I am not running NANO and im not using memory disk. The system runs on a dedicated 32GB SSD.

I took a chance to experiment more and I changed the update time to every 2min for testing. Before it had been set for 10-12 hours for testing. To break it down.

set for 23 hours. no update for several days.

change to 10-12 hours updates apply after 10 hours.

more than 12 hours go by no update.

Switch to 2min updates apply 2min later.

5min go by no update.

It seems like its not resetting after the updates apply?

BUT The logs say this

Aug 31 22:13:36   configd.py: [e0bdcf55-61af-4d6a-87e2-f763fa23091a] get suricata daemon status
Aug 31 22:13:36   configd.py: [7ed96fa6-b30b-45f0-8365-32f90e886b57] request installable rules
Aug 31 22:12:35   configd.py: [de0f384a-5e35-4087-bfbd-a5bedce859ff] get suricata daemon status
Aug 31 22:12:35   configd.py: [6440d91a-dd80-4eaf-a7eb-87f5bd48da42] request installable rules
Aug 31 22:11:03   configd.py: [5da71fad-9fea-4297-94d6-4895c632dd62] get suricata daemon status
Aug 31 22:11:03   configd.py: [c09d7ee2-8ece-4a1b-a492-7e8cc4b940f6] request installable rules
Aug 31 22:09:36   configd.py: [e4478128-8b7c-4894-a25e-6b0879c137cc] get suricata daemon status
Aug 31 22:09:36   configd.py: [4393efa3-7de5-4339-ba4c-9a60b50ac96b] request installable rules
Aug 31 22:06:53   configd.py: [3a81d941-cab0-4692-b8bb-974a9189834a] get suricata daemon status
Aug 31 22:06:53   configd.py: [bca87310-06f5-49a6-bf5a-1fce0b1f8a89] request installable rules
Aug 31 22:06:50   configd.py: [03359858-4864-4b89-9144-09cc22e49b33] get suricata daemon status
Aug 31 22:06:50   configd.py: [41778be4-0bea-4886-854b-602b5f9ae100] request installable rules
Aug 31 22:06:47   configd.py: [9e6b7f72-b3f2-44fa-ae0d-0b299f931cc2] restarting cron

Maybe the IDS page itself simply has a lag time between when the rules get updated and when teh time stamp changes on teh status page?

I hope any of this provides help. If I am being a stupid user though please just lmk. The thought did cross my mind that perhaps the windows for updates was too short (sub 10min intervals) and that maybe the rules hadn't finished propagating when the next request was called thus stopping the update?

I cant wait! security is good!

hm have you tried doing a memtest? I'm not actually fantastic at networking. but im actually very good with hardware if BSD is indicating watchdog errors than the fault may actually lie with the overall system stability. The previous edition working could have simply been coincidence. Can you take this machine offline to run extended diagnostics? Are you able to get any thermal measurements from the CPU? Does SMART indicate drive failure?

First Id like to start with my build data

OPNsense 15.7_824-amd64   
FreeBSD 10.2-RELEASE-p1   
LibreSSL 2.2.2

My issue however also happened on 10.1 and the vanilla 15.7.X build. though since iv upgraded I have forgotten my sub version number.

My issue is that the IDS rules do not auto update. Attached is the configuration I would like to use. A standard check once a day. However when going into my IDS today I noticed they have not been updated since the 27th. before my upgrade to both 10.2 and _824. I then went and modified the schedule to update in 1 minute intervals for testing. After about 5 the rules still had not updated. I am hoping this is some kind of configuration issue. Does anyone have any insight?

are these changes also reflected in the 10.2 snapshot?

So just to be clear. If we "upgrade" to 10.2 we shouldn't "update" from within the firmware after the 10.2 "upgrade"  or we will be "downgraded" back to 10.1?

Thanks! I will comb through the options too see exactly what I dont need and this should curb the log usage. Its a shame I deleted it honestly. I would be interested to know which one was filling the log that quickly.

Did you set it to log everything?

I don't believe so. I also cleared the logs and the space actually didn't go down at all. So it seems log files arent even the culprit. at 21 hours in currently im at 13gb used from 11 when I made the OP.

Took a closer look via SSH

using df -h in shell I was able to confim the usage.

I then used du -h to see what directory was using the space. turns out its suricata. I have everything checked (selected) and updated. There seems to be no setting to control log size. would anyone know how to clear them? maybe I have a configuration issue?

tried to rm /var/log/suricata/status.log which removed it however the space is the same. killed syslog (cant reboot atm) i'll reboot the machine when the network isnt so busy. Still have the space condition. apparently suricata logs every 8 seconds by default.

rebooting the unit had no effect :(

tracked it down. ran du -k on everything in the suricata dir and found out it was actually eve.json taking up the space. I'm looking into what if anything can be done about tis size.

I just deleted it for now. Looks like suricata is supposed to have a log limit size of 32mb but then rolls over and starts a new one. it appears to rely on anotehr program to clean up old log files.

https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Suricatayaml

Suricata in itself however does have a configuration that im unsure how to getto or modify (BSD makes me cry)

https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Suricatayaml

a really neat feature though that would be cool if implemented though is support for logtash

https://redmine.openinfosecfoundation.org/projects/suricata/wiki/_logstash_kibana_and_suricata_json_output

its a nifty gui that might be useful in parsing the actual suricata logs.

Im still trying to understand how we can limit the size though.

Hi! I have recently installed OPNsense and currently over the 20 hours it has been running I have 11GB of log files. My SSD is only 32GB when I go into settings the feild for log file size is blank. I dont mind it using the space (not much else to use it for really) but will this start to cause issues as the drive gets mroe full? will opnsense have enough space provisioned for updates via another partitions? will old logs be deleted to make room for new logs?

do I have a problem I should correct?

Don't mean to double post but Just wanted to update you guys on this for reasons. Went ahead and bought the following. Knowing after that realtek chips apparently arent that great at this kind of thing. /shrug.

The machine.

http://www.newegg.com/Product/Product.aspx?Item=N82E16856101162

The CPU

http://www.newegg.com/Product/Product.aspx?Item=N82E16819116974

the ram

http://www.newegg.com/Product/Product.aspx?Item=N82E16820231768&cm_re=gskill_1333-_-20-231-768-_-Product

SSD

http://www.newegg.com/Product/Product.aspx?Item=N82E16820211717

Currently it works great!

http://www.speedtest.net/result/4583687351.png

I totally forgot an AP though (DAMNIT) but ill get one next week or so.

I had a bit of an issue setting up. forgot to release the IP provided by my ONT which kept my router from gaining a WAN IP but I got it figured out. The thermal probs, smart data, and graphs work fine with this setup. im loving the options and granularity so far. Happy to have gotten off of consumer routers. Loving the experience so far!

Thats great news! I'm relieved I can't wait to use it I wish I could control shipping! Again been watching this project for awhile absolutely love what you and the team are doing! Good job!

Hi everyone! its taken months too get signed up entered the wrong email for activation and only recently found the link to fix that lol oops.

I have to say I love the project! I am very excited to dive into opnsense and I am super happy (mostly because I was specifically waiting for) that an IDS has been implemented and is now default on WAN (THANK YOU!) With my excitement to dive in I made have made a mistake. I hope this is ok to ask here if not please show me to the road to hardware compatibility. I bought a bare bones machine with DUAL NICs the chipsets are Realtek 8111Gs unfortunately I didn't realize Realtek was pretty much taboo for BSD.

That said since its a home I am not too worried about performance degradation ATM I will replace if necessary of course. My question is opnsense compatible with the 8111G chips? I have seen issues googling. Most were found in posts dated from 2013 in the pfsense forums. promising implementation in 10 alpha. I was just wondering if any version of opnsense currently or in the future supports these before I attempt to cancel the order or return it.

Thanks much! can't wait to get started!!