Update from 26.1.3 to .4 hangs

[cibomato]

Hi all,

Update from 26.1.3 to .4 hangs at
CLI check-fix done
and nothing more happens.
Any idea?

Thanks and best regards,
Jochen

[franco]

Hi Jochen,

Can you give more context? I don't think that text originates from our core or plugins code so it's likely a ports package.


Cheers,
Franco

[Baxajaun]

Hi !!!

Yesterday i updated from 26.1.3 to 26.1.4 without problems. All was OK.

Best regards,

[cibomato]

Hi Franco,

I assume it could be sensei, this is the output:

***GOT REQUEST TO UPDATE***
Currently running OPNsense 26.1.3 (amd64) at Wed Mar 11 23:49:44 CET 2026
Updating OPNsense repository catalogue...
OPNsense repository is up to date.
Updating SunnyValley repository catalogue...
Fetching meta.conf: . done
SunnyValley repository is up to date.
All repositories are up to date.
Updating OPNsense repository catalogue...
OPNsense repository is up to date.
Updating SunnyValley repository catalogue...
Fetching meta.conf: . done
SunnyValley repository is up to date.
All repositories are up to date.
Checking for upgrades (184 candidates): .......... done
Processing candidates (184 candidates): . done
The following 11 package(s) will be affected (of 0 checked):

New packages to be INSTALLED:
   colordiff: 1.0.22 [OPNsense]

Installed packages to be UPGRADED:
   crowdsec: 1.7.6_1 -> 1.7.6_2 [OPNsense]
   crowdsec-firewall-bouncer: 0.0.32_12 -> 0.0.34 [OPNsense]
   libunistring: 1.4.1 -> 1.4.2 [OPNsense]
   libxml2: 2.15.1_1 -> 2.15.2 [OPNsense]
   opnsense: 26.1.3 -> 26.1.4 [OPNsense]
   opnsense-lang: 26.1.1 -> 26.1.4 [OPNsense]
   os-sensei: 2.4 -> 2.4.1 [SunnyValley]
   strongswan: 6.0.3_1 -> 6.0.4 [OPNsense]
   suricata: 8.0.3_1 -> 8.0.3_2 [OPNsense]
   syslog-ng: 4.10.2 -> 4.11.0 [OPNsense]

Number of packages to be installed: 1
Number of packages to be upgraded: 10

203 MiB to be downloaded.
[ 1/11] Fetching libunistring-1.4.2: .......... done
[ 2/11] Fetching crowdsec-1.7.6_2: .......... done
[ 3/11] Fetching libxml2-2.15.2: .......... done
[ 4/11] Fetching crowdsec-firewall-bouncer-0.0.34: .......... done
[ 5/11] Fetching syslog-ng-4.11.0: .......... done
[ 6/11] Fetching colordiff-1.0.22: .. done
[ 7/11] Fetching os-sensei-2.4.1: .......... done
[ 8/11] Fetching suricata-8.0.3_2: .......... done
[ 9/11] Fetching opnsense-26.1.4: .......... done
[10/11] Fetching strongswan-6.0.4: .......... done
[11/11] Fetching opnsense-lang-26.1.4: .......... done
Checking integrity... done (0 conflicting)
[ 1/11] Installing colordiff-1.0.22...
[ 1/11] Extracting colordiff-1.0.22: ...... done
[ 2/11] Upgrading crowdsec-firewall-bouncer from 0.0.32_12 to 0.0.34...
[ 2/11] Extracting crowdsec-firewall-bouncer-0.0.34: ...... done
crowdsec_firewall is running as pid 39530.
Stopping crowdsec_firewall.
[ 3/11] Upgrading crowdsec from 1.7.6_1 to 1.7.6_2...
[ 3/11] Extracting crowdsec-1.7.6_2: .......... done
crowdsec is running as pid 31617.
Stopping crowdsec.
Waiting for PIDS: 31617.
Updating crowdsec hub data
Downloading /usr/local/etc/crowdsec/hub/.index.json
update for collection crowdsecurity/freebsd available (currently:0.4, latest:0.5)
update for collection crowdsecurity/opnsense available (currently:0.4, latest:0.5)
update for collection crowdsecurity/whitelist-good-actors available (currently:0.2, latest:0.3)
update for collection crowdsecurity/opnsense-gui available (currently:0.1, latest:0.2)
update for collection crowdsecurity/sshd available (currently:0.8, latest:0.9)
update for collection firewallservices/pf available (currently:0.2, latest:0.3)
downloading collections:crowdsecurity/sshd
downloading collections:crowdsecurity/whitelist-good-actors
downloading collections:crowdsecurity/freebsd
downloading collections:crowdsecurity/opnsense-gui
downloading collections:firewallservices/pf
downloading collections:crowdsecurity/opnsense

Run 'sudo service crowdsec reload' for the new configuration to be effective.
Loaded: 160 parsers, 11 postoverflows, 774 scenarios, 9 contexts, 5 appsec-configs, 193 appsec-rules, 160 collections
Starting crowdsec.
[ 4/11] Upgrading libunistring from 1.4.1 to 1.4.2...
[ 4/11] Extracting libunistring-1.4.2: .......... done
[ 5/11] Upgrading libxml2 from 2.15.1_1 to 2.15.2...
[ 5/11] Extracting libxml2-2.15.2: .......... done
[ 6/11] Upgrading opnsense-lang from 26.1.1 to 26.1.4...
[ 6/11] Extracting opnsense-lang-26.1.4: .......... done
[ 7/11] Upgrading os-sensei from 2.4 to 2.4.1...
[ 7/11] Extracting os-sensei-2.4.1: .......... done
Zenarmor service is running, saving state to resume after upgrade...
Removing Zenarmor cron jobs...
CLI crons: Info: Cron jobs deleted: 1
CLI crons: Success
Local path is : /usr/local/opnsense/service
total 61
-rw-r--r--  1 root wheel    0B Sep  6  2025 .fixed-security-categories
-rw-r-----  1 root wheel   32B Sep  6  2025 serial
-rw-r-----  1 root wheel    7B Oct 10 00:22 sensei_cpu_score
-rw-r-----  1 root wheel   32B Oct 10 00:28 token
-rw-r-----  1 root wheel    4B Oct 10 00:29 .configdone
-rw-r-----  1 root wheel  113B Oct 10 00:29 overlay.conf.templ
-rw-r-----  1 root wheel  236B Mar  4 23:58 workers.map
-rw-r--r--  1 root wheel  113B Mar  4 23:58 overlay.conf
-rw-r--r--  1 root wheel    0B Mar  4 23:58 .mustrestart
-rw-r--r--  1 root wheel  6.2K Mar  5 00:01 eastpect.cfg
-rwxr-xr-x  1 root wheel  136B Mar  5 08:14 workers.map.default
-rwxr-xr-x  1 root wheel   40B Mar  5 08:14 .buildtime
-rwxr-xr-x  1 root wheel  5.5K Mar  5 08:14 eastpect.cfg.default
create link for python in virtualenv...Create link python3 to /usr/local/zenarmor/py_venv/bin/python....
Create link python3 to /usr/local/zenarmor/py_venv/bin/python3....
done
Restarting configd service...done
Activating features for Freemium Edition...
Clearing OPNsense menu cache...done
Invalidating OPNsense cache...done
Invalidating Zenarmor cache...done
Running Zenarmor post-install scripts...
Check python version
Wed Mar 11 22:50:23 UTC 2026
Removing Zenarmor cron jobs...
CLI crons: Info: Cron jobs deleted: 0
CLI crons: Success
Preparing Settings Db...
Backup configurations...
Configuration Migration .....
License Migration.....
Node.csv Migration.....
Certification Migration.....
Token Migration.....
Userpin Migration.....
Serial Migration.....
Userenricher Tokens Migration.....
Hostmap Cache Database migration.....
Creating user_device_cache.db...
Creating hostmap_cache.db...
Creating settings.db...
Application database base path is /usr/local/zenarmor//db/
12 web 2.0 categories added.
Prepared Default Policy
Checking Schedule Reports...
Preparing Userenrich Db...
Checking Cloud Nodes...Setting new cloud nodes...done
ASAN LIBRARY CHECK....
Generating Zenarmor configuration files...done
Menu.xml template copied
StaticConfig template copied
CLI generate-static-file: OK
CLI setretireafter:
CLI setretireafter: DB Type: SQ
SqLite Retire After: 2
CLI setretireafter: Skipped:
CLI setflavor:
CLI setflavor: Warning: Not settings flavor size in eastpect.cfg
CLI settimestamp: Success
CLI migrate: Info: Report Mail Configuration Checking
CLI migrate: Info: done
CLI migrate: Info: Web category migration ...
CLI migrate: Info: done
CLI migrate: Info: Custom web category migration ...
CLI migrate: Info: done
CLI migrate: Info: Applications category migration ...
CLI migrate: Success
CLI migratewebcat: Success
CLI bufsysctl (ring): skipped dev.netmap.ring_num: 1024
CLI bufsysctl: skipped  mem: 8589934592 buf: 1000000
CLI setdefaultswap: Info: Swap Rate: 60
CLI setdefaultswap: Success
CLI fillscheduledreportchart
CLI fillscheduledreportchart: Success
CLI setlicensesize: Success: Warning: License is not premium
CLI check-fix-websites skipped
CLI check-fix... 
CLI check-fix done


It hangs at this point, even after reboot.
What could I do? Stop / uninstall Zenarmor?

Thanks and best regards,
Jochen

[franco]

I'd try this

# killall pkg pkg-static

And restart the update from the GUI.

If this works you should ask in Zenarmor forum what happened.


Cheers,
Franco

[jonny5]

Saw a different error specifically saying pkg-static wouldn't let go of the db, ran the kill command, it said it didn't find anything to kill, re-ran the update, it worked.

Rebooted the router, everything is coming up nicely, thank you OPNSense and Franco!!

[franco]

Yeah this can sometimes happen... even being stuck eternally until killed or rebooted.


Cheers,
Franco