Increased CPU usage from CrowdSec after updating to OPNsense 26.7

[josephistired]

After updating my firewall to OPNsense 26.7, I've noticed that the CrowdSec plugin appears to be using significantly more CPU (upwards of 100%) than it did before the update.

Has anyone else experienced this after upgrading, or is this a known issue with 26.7?

For reference, here's some information about my system:

OPNsense version:

OPNsense 26.7 (amd64)

CrowdSec version:

version: v1.7.8_1-6322745
Codename: alphaga
BuildDate: 2026-07-06_18:59:29
GoVersion: 1.26.4
Platform: freebsd
libre2: C++
User-Agent: crowdsec/v1.7.8_1-6322745-freebsd
Constraint_parser: >= 1.0, <= 3.0
Constraint_scenario: >= 1.0, <= 3.0
Constraint_api: v1
Constraint_acquis: >= 1.0, < 2.0

Built-in optional components: datasource_appsec, datasource_cloudwatch, datasource_docker, datasource_file, datasource_http, datasource_journalctl, datasource_k8s-audit, datasource_kafka, datasource_kinesis, datasource_loki, datasource_s3, datasource_syslog, datasource_victorialogs, datasource_wineventlog, db_mysql, db_postgres, db_sqlite Excluded components: cscli_setup Hardware: hw.model: Intel(R) N200 If there are any additional logs or diagnostics that would be helpful, please let me know, and I'd be happy to provide them. Thanks!

[PoMpIs]

I use the same version of CrowdSec and it still works the same as in 26.1... I don't have any more CPU usage. I think since I updated to 26.7 I have less CPU usage overall. It works very, very well. 👌

Code Select Expand

crowdsec -version
version: v1.7.8_1-6322745
Codename: alphaga
BuildDate: 2026-07-06_18:59:29
GoVersion: 1.26.4
Platform: freebsd
libre2: C++
User-Agent: crowdsec/v1.7.8_1-6322745-freebsd
Constraint_parser: >= 1.0, <= 3.0
Constraint_scenario: >= 1.0, <= 3.0
Constraint_api: v1
Constraint_acquis: >= 1.0, < 2.0
Built-in optional components: datasource_appsec, datasource_cloudwatch, datasource_docker, datasource_file, datasource_http, datasource_journalctl, datasource_k8s-audit, datasource_kafka, datasource_kinesis, datasource_loki, datasource_s3, datasource_syslog, datasource_victorialogs, datasource_wineventlog, db_mysql, db_postgres, db_sqlite
Excluded components: cscli_setup

[nero355]

If there are any additional logs or diagnostics that would be helpful, please let me know, and I'd be happy to provide them.

You could have added your top output to the opening post ;)

[josephistired]

I should've added the top output, my bad.

last pid: 73859;  load averages:  3.17,  2.90,  2.81  up 23+00:00:57    20:57:58
77 processes: 2 running, 75 sleeping
CPU:  0.0% user,  0.0% nice,  4.3% system,  0.0% interrupt, 95.7% idle
Mem: 403M Active, 728M Inact, 13G Wired, 497M Buf, 12G Free
ARC: 10G Total, 3148M MFU, 6877M MRU, 380K Anon, 56M Header, 161M Other
     7965M Compressed, 13G Uncompressed, 1.67:1 Ratio
Swap: 2048M Total, 2048M Free

  PID USERNAME    PRI NICE   SIZE    RES STATE    C   TIME    WCPU COMMAND
21006 root          20    0  1189M   206M CPU0     0  44:28 297.18% crowdsec
23548 root          20    0  2884M    91M CPU2     2   4:58   4.74% python3.11
19907 root          20    0   454M   101M CPU1     1  26:22   0.34% suricata
...