[SOLVED] hostwatch at 100% CPU

[tessus]

when I switch into the shell and enter "hostwatch --version" it shows 1.0.2 even 1.0.9 packet is installed.

Yep, the manifest was not updated: see https://github.com/opnsense/hostwatch/blob/1.0.9/Cargo.toml

I believe the release workflow is not yet stabilized. I will open an issue to make a few suggestions.

[franco]

It was updated in .11 https://github.com/opnsense/hostwatch/commit/5f35418

[0xd]

I wasn't sure if the update clears the database so here is an attempt to save someone some time:

Web UI: System->Settings->Administration:
Check:
Enable Secure Shell
Permit root user login
Permit password login
Apply

ssh root@<yourgateway>

root@OPNsense:/var/db/hostwatch # ls -lh
total 207598624
-rw-r--r--  1 hostd hostd  4.0M Jan 30 17:30 hosts.db
-rw-r--r--  1 hostd hostd  393M Jan 30 18:05 hosts.db-shm
-rw-r--r--  1 hostd hostd  198G Jan 30 18:05 hosts.db-wal

service hostwatch stop
rm -rf /var/db/hostwatch/*

Update to OPNsense 26.1_4:
exit
12) Update from console

Web UI: System->Settings->Administration:
Uncheck:
Enable Secure Shell
Permit root user login
Permit password login
Apply

[franco]

The .11 in 26.1_4 enforces the proper cleanup now. Just make sure to restart after update.


Cheers,
Franco

[hugo]

I'm not really clear if it's expected that 1.0.11 should fix hostwatch filling up disks from the sqlite DB records. I installed 26.1 fresh yesterday, patched up to 26.1_4, which I understand runs hostwatch 1.0.11. hostwatch still filled up my entire disk (~20 GB of disk space used) in under 6 hours.

Our provider (coax/DOCSIS) makes the WAN *extremely* chatty at ~1,200 received ARP requests per second. I've disabled hostwatch to avoid this causing me issues again. Blanket enabling hostwatch by default on host interfaces is really risky to users, imho, unless its disk usage can be constrained.