Cancelling my subscription: feedback on the home-user value proposition

[Greg_E]

That is something to consider, I hadn't thought about the storage being any part of the slowness. There are other reason to buy the product, the policies flexibility is one of them. And when you find a product that you like, it's nice when you can support it and keep it moving forward.

[abenaou]

That is something to consider, I hadn't thought about the storage being any part of the slowness. There are other reason to buy the product, the policies flexibility is one of them. And when you find a product that you like, it's nice when you can support it and keep it moving forward.

For me what gave me the hint is these errors  :

Code Select Expand

[52805] 196.658358 [1089] netmap_obj_free          ouch, double free on buffer 18426

[52805] 196.658370 [1089] netmap_obj_free          ouch, double free on buffer 18428

[52805] 196.658381 [1089] netmap_obj_free          ouch, double free on buffer 18432

[52807] igb1: link state changed to UP

[52854] swap_pager: indefinite wait buffer: bufobj: 0, blkno: 2101141, size: 65536

[52866] swap_pager: indefinite wait buffer: bufobj: 0, blkno: 2108016, size: 16384

[52874] swap_pager: indefinite wait buffer: bufobj: 0, blkno: 2101141, size: 65536

[52886] swap_pager: indefinite wait buffer: bufobj: 0, blkno: 2108016, size: 16384
Also, I noticed that sometimes the zenarmor live  session dashboard would throw a : Error (200), and that anything related to zenarmor was way too slow (policies, reports), and this had a snowball effect, SQLite has a single writer, it cannot write concurrently write data, having a dramless nvme meant that SQLite would "run out" of IOPS meaning that while locking the database it was also making zenarmor wait and freeze, it  caused a cascading failure where SQLite would get stuck, dragging zenarmor and then the netmap driver making the nics flap very often.

I think the most reliable solution would be to externalize elasticsearch, even if you install it locally you would reserve a big amount of resources to elasticsearch and might hit a performance bottleneck.

I know the Zenarmor team have their reasons for removing remote database support from the free tier plan, but it is almost a must to fully experience the benefits of the product, and this is not mentioned anywhere, and some people, me included, simply underestimate how demanding to run SQLite as a back-end, which means that it would be difficult to really appreciate the free tier without remote database support.

[Greg_E]

Maybe I'll have to see if my new hardware has an extra nvme slot and I can put in a database drive and just let it get beat on, but also be nice and fast.

[abenaou]

Maybe I'll have to see if my new hardware has an extra nvme slot and I can put in a database drive and just let it get beat on, but also be nice and fast.

That was my plan as well, but my machine doesn't have an extra nvme slot and I didn't want to go through the hassle of reinstalling and moving configurations and the license, so I thought why not use that laying around nvme on Proxmox as a dedicated storage for fast things? that's how it all started, in retro-perspective it was the better decision, so if you have an hypervisor, spinning a vm with a pci pass-through can alleviate shift the load to the vm instead of OPNsense. 

[colourcode]

I've learned that it is better to let the firewall do its thing, and let the vms/containers do their thing.

Having a process constantly writing data, especially a database, will have at some point a CPU load high enough to slow down other functionalities on the firewall, I am not even mentioning IOPS, sqlite was basically chocking my firewall and had to dig in the logs to find the culprit, I wasn't aware of putting sqlite in the ram other than tmpfs which I always found a bit too risky for data I cared about.

But once you externalize the database things become more predictable even under high load, this being said, the free version might not necessarily give the best user experience unless you have some specific hardware (fast nvme with dram cache), but in my experience sqlite+dramless nvme was a pure recipe for headaches, because the free version the last time I tested doesn't offer the option to use an external elasticsearch instance which would definitely have consequences if a user doesn't have the "right" hardware.
[/quote]

What kind of traffic and host count are we talking about where you manage to practically kill the device?
I'd be very interested to see if your problem also dissappears with the DB mounted as TMPFS. I assume you bumped the history way up from 2 days if you care about historical data.

Unfortunately my ISP don't offer 2.5 so I can't test higher than 1gbps from my end.

The only errors i've seen running this on a n305 under proxmox (6 of 8 cores to opnsense) is netmap stalling - reproducable with torrent traffic (wg on opnsense) and steam downloads etc.