High CPU Usage by Eastpect Process - Zenarmor Plugin Issue on OPNsense 24.7_9

[kozistan]

I am having an issue with the eastpect process consuming all processing resources:

Code: [Select]

51818 root         11  48  -20  4623M   393M RUN      4  20:39  99.16% eastpect
49088 root         11  36  -20  4624M   396M RUN      2  20:31  98.70% eastpect
50751 root         11  42  -20  4623M   392M RUN      7  20:31  95.33% eastpect

I have the Elasticsearch database external and the Memory Disk Size set to 500MB. After investigating possible causes, I concluded that Zenarmor might be the reason. I have the plugin version 1.17.5 installed, and I am on OPNsense 24.7_9.

I tried restarting the service, but it immediately spikes back to the previous numbers. The same situation occurred yesterday, and the only solution was to restart the firewall, but I do not want to restart the firewall every time this type of issue arises. I have 150 clients in production.

Code: [Select]

root@fw:/usr/local/zenarmor/output/active/temp # df
Filesystem                1K-blocks     Used    Avail Capacity  Mounted on
zroot/ROOT/default        110187668 19465572 90722096    18%    /
devfs                             1        0        1     0%    /dev
/dev/gpt/efiboot0            266144     1840   264304     1%    /boot/efi
fdescfs                           1        0        1     0%    /dev/fd
procfs                            8        0        8     0%    /proc
zroot/var/mail             90722232      136 90722096     0%    /var/mail
zroot/tmp                  90727056     4960 90722096     0%    /tmp
zroot                      90722192       96 90722096     0%    /zroot
zroot/var/crash            90722192       96 90722096     0%    /var/crash
zroot/var/audit            90722192       96 90722096     0%    /var/audit
zroot/var/tmp              90722212      116 90722096     0%    /var/tmp
zroot/usr/src              90722192       96 90722096     0%    /usr/src
zroot/usr/ports            90722192       96 90722096     0%    /usr/ports
zroot/var/log              93674056  2951960 90722096     3%    /var/log
zroot/usr/home             90722192       96 90722096     0%    /usr/home
devfs                             1        0        1     0%    /var/dhcpd/dev
/dev/md43                    495516      752   455124     0%    /usr/local/zenarmor/output/active/temp
devfs                             1        0        1     0%    /var/captiveportal/zone0/dev
devfs                             1        0        1     0%    /var/captiveportal/zone1/dev
devfs                             1        0        1     0%    /var/unbound/dev
tmpfs                        358400   265748    92652    74%    /usr/local/zenarmor/run/tracefs
devfs                             1        0        1     0%    /var/unbound/dev
/usr/local/lib/python3.11 110187668 19465572 90722096    18%    /var/unbound/usr/local/lib/python3.11
/lib                      110187668 19465572 90722096    18%    /var/unbound/lib

I hope someone can help me troubleshoot this issue without having to resort to frequent firewall restarts. Thank you!

[sy]

Hi,

Please share the last stats of /usr/local/zenarmor/log/stat/memstat*.log files.

[kozistan]

logs sent, thanks sy

[Sam of Ham]

I believe I might be having a similar issue - replying here to follow this thread!

My ZA issue is a repeating:

Code: [Select]

os-sensei is missing a required shared library: libpython3.9.so.1.0problem, but this is something I want to watch and cross-check over the next few days too.

[sy]

Hi,

This seems a repo issue. Please remove os-sunnyvalley plugin and re-add it in System - Settings - Firmware - Plugin menu. Then please run the following command on CLI

pkg install -fy os-sensei

[sy]

Hi,

The business repo is updated. If you reinstall the package with pkg install -fy os-sensei, the issue should be fixed.