CPU spikes from update_tables.py and syslog-ng

[uxian]

I'm running a pretty vanilla OPNsense setup on a cheap J4125 mini PC (with Intel NICs). It's a fully updated 22.1.8_1 setup and my only real customisation is to forward some DNS from Unbound to BIND for wildcard A records. Recently, I started seeing issues with 1.5 second lag spikes while playing an online game and the problem seems to be coming from the router rather than anything to do with the game's infrastructure. On the dashboard I can see periodic CPU spikes between 30 and 70 percent. I'm not running netflow or any intrusion detection/prevention.

I ended up installing htop and atop from the ports repo to analyse it and I'm seeing a couple of specific processes hitting high CPU levels - update_tables.py seems to hit high CPU % every time it runs and syslog-ng is occasionally showing up as 200 or 300% CPU usage in atop though that doesn't correspond with the spikes in the dashboard.

I don't have either of these configured with anything other than defaults. My only aliases are the default bogons, bogonsv6, virusprot, sshlockout and I haven't configured any syslog forwarding. I'm also not using any aliases in any of my firewall rules (I block everything inbound on the WAN port anyway).

For now, I've modified the root crontab to execute update_tables.py only once per day but that doesn't seem ideal and modifying firewall settings sometimes resets the crontab back to default.

Does anyone have any idea what might be happening or how to resolve it other than switching to a more powerful device?

[defaultuserfoo]

Before switching to a more powerful device, I would want to verify if the business of the CPU actually has anything to do with what you call 'lag spikes'.  Maybe there is a way to make the CPU busy all the time so you can verify if that does make a difference.

[uxian]

That's a good call, thanks. I've done some experimentation and it seems it's not as simple as CPU saturation. Running update_tables.py directly or even running stress-ng to saturate all 4 cores for 10+ seconds has little immediate effect on the ping round-trips (I'm testing from the gaming rig using WinMTR) and yet with the cron job disabled and syslog-ng stopped I'm still seeing periodic 500ms+ round-trips to my router over a wired connection when the game is running.

I guess I'll have to look elsewhere to see if something is flooding the network or affecting the NIC on the gaming rig (it's an Intel I-255V on an Asus motherboard which is known to have issues anyway - perhaps a new NIC for the gaming PC might be a better investment).

[uxian]

Yup, plugged in the cheap USB-C network adapter I had laying around and... no more latency.