[SOLVED] hostwatch at 100% CPU

[LHoust]

I was also observing hostwatch running at nearly 100% CPU...

I Proof my OPNsense Updates within a VirtualBox VM running on an Ubuntu 24.04.3 Host, where my /home Partition sits on a HDD...

With 25.7.11_2 I was also observing a Serious Level of HDD Thrashing, until I disabled Automatic Discovery!!!

[passeri]

Just to mention, on one test box and two operational boxes, all bare metal Intel and AMD, hostwatch trots along quietly with no untoward CPU spikes or log writes. Three principal subnets (no vlans), all IPv4, around 25 devices.

[LHoust]

I was also observing hostwatch running at nearly 100% CPU...

I Proof my OPNsense Updates within a VirtualBox VM running on an Ubuntu 24.04.3 Host, where my /home Partition sits on a HDD...

With 25.7.11_2 I was also observing a Serious Level of HDD Thrashing, until I disabled Automatic Discovery!!!

For Proofing Updates, I also run OPNsense 25.7 within a Workstation VMPlayer VM: Host is Windows 11 (C: Drive is a SSD)...

Everthing seems "Quite" HERE??

[iMx]

I updated from 25.1.x -> 25.7.11_2-amd64 and whilst I didn't see the logs/disk usage growing (due to the _2 hot fix), having automatic discovery did lead to increased writes for me.

... not massive, but unnecessary in my view.  Screenshot attached - you can see when I disabled it, just after 16:00.  Auto Neighbour Discovery is unnecessary for my usage.

Personal preference would be that this is disabled by default, but it seems like I'll just need to remember to disable it on new builds/installs now!

For anyone that is curious, you can use iostat 1 (UFS) or zpool iostat -v 1 (zfs)

[EHRETic]

Hi there,

My 5 cents, also had this issue with 25.7.11_2 : it filed up one my FW hard disk in less than an hour.

What's relevant in my case (or weird) : I have a pair of FWs in HA mode and this morning, I did a rule update that I synced with the passive node and only the passive node started to fill up the HD after I did the sync.

I think I updated to  25.7.11_2 the day of publishing and I saw no problem until today.

Weird no? 😉

PS: what should I clean to get some space back?

[Patrick M. Hausen]

PS: what should I clean to get some space back?

Code Select Expand

/var/log/hostwatch/*


[EHRETic]

Code Select Expand

/var/log/hostwatch/*


Thanks a lot for this super fast answer, this helped a lot! 😊

[LHoust]

I was also observing hostwatch running at nearly 100% CPU...

I Proof my OPNsense Updates within a VirtualBox VM running on an Ubuntu 24.04.3 Host, where my /home Partition sits on a HDD...

With 25.7.11_2 I was also observing a Serious Level of HDD Thrashing, until I disabled Automatic Discovery!!!

For Proofing Updates, I also run OPNsense 25.7 within a Workstation VMPlayer VM: Host is Windows 11 (C: Drive is a SSD)...

Everthing seems "Quite" HERE??

"Update on the 50 MB/s Thrashing: I have isolated the trigger. The issue occurs only when the VirtualBox WAN adapter is set to 'Bridged Adapter' on a host with multiple virtual interfaces (Tailscale, VMware hooks). When switched to 'NAT', the thrashing stops.

This suggests Hostwatch is attempting to perform neighbor discovery on the host's 'shadow' virtual interfaces visible through the bridge, failing, and entering a high-frequency SQLite write loop. Since VirtualBox defaults to NAT, most users are likely bypassing this bug by accident."