System unusable after starting Zenarmor since 26.1

[mekano]

Every time i start zenarmor engine, my system is unusable because de CPU goes to 100% usage. Zenarmor is configure to don't start at boot so when this happens i reboot the computer to make it accessible again. I have a protectli VP2420 with 16 gig of ram. Everything was working fine before that.

I don't know why this is happening. Anyone in the same situation ?

[Seimus]

Hello,

What deployment you are using, driver, interfaces, DB, etc. ?
Did you check top output?

If its ZA doing this,
Best to contact ZA support directly via a ticket using the UI.


Regards,
S.

[notspam]

Protectli VP2420 with 16 GB of RAM ......

Intel Celeron J6412
* Quad Core
* 1,5 MB L2-Cache
* 2,0 GHz with burst till 2,6 GHz
* Intel AES-NI hardware acceleration

is really fast enough.
A mismatch with suricata on the same interface ?

100% is in top viewed on cli?
And which are the processes using the whole cpu cores ?

Zenarmor free edition can only use 1 cpu core.

[(MARLOO)]

Hi all,

I had a similar issue on a N5105 box with 4x I226-V (igc) and Zenarmor enabled.

On 27–28 Sep the firewall froze completely (no SSH, no web UI, no ping) and required a hard reboot.
System logs showed repeated netmap TX stalls on LAN:

<13>1 2026-09-27T21:30:39+02:00 OPNsense kernel - netmap_transmit igcx full hwcur 515 hwtail 515 qlen 1023 
<13>1 2026-09-28T01:21:37+02:00 OPNsense kernel - netmap_transmit igcx full hwcur 515 hwtail 515 qlen 1023 

Note: "mekano" hasn't posted any logs.

From their description, their issue looks more like memory exhaustion (Elasticsearch + Zenarmor) than an igc/netmap driver stall like in my case.

HW/SW: N5105, 4x I226-V, OPNsense 26.7.4_1, Zenarmor enabled on multiple VLANs, Suricata disabled.

What fixed it:

- Tunables:
net.inet.tcp.tso = 0 
dev.igc.x.lro = 0 
dev.igc.x.lro = 0 
dev.igc.x.lro = 0 
dev.igc.x.lro = 0 
dev.igc.x.eee_control = 0 
dev.igc.x.eee_control = 0 
dev.igc.x.eee_control = 0 
dev.igc.x.eee_control = 0 
hw.pci.enable_aspm = 0 
vfs.zfs.arc_max = 3221225472 

After reboot: no more "netmap_transmit igcx full" messages, igcx shows 1000baseT full-duplex, system and Zenarmor are stable.

I'm still monitoring to confirm long-term stability..

I've opened a Zenarmor ticket with logs and tunables, but for me the problem is already fixed.

If anyone else is hitting netmap TX stalls on I226-V with Zenarmor, these tunables plus forcing 1G full-duplex have worked for me so far.