Very high SSD writes with Zenarmor + SQLite

[bodenlos]

I noticed unusually high SSD wear on an OPNsense system and started tracing the write activity.

A controlled A/B test using the NVMe SMART [tt]Data Units Written[/tt] counter showed a very large difference depending on whether the Zenarmor engine was running.

Zenarmor OFF, 16 minutes


212,834,990 -> 212,837,079

= 2,089 data units 
≈ 1.07 GB written in 16 minutes 
≈ 96 GB/day extrapolated

Zenarmor ON, 16 minutes


212,837,079 -> 212,845,277

= 8,198 data units 
≈ 4.20 GB written in 16 minutes 
≈ 378 GB/day extrapolated

So in this test, enabling Zenarmor increased total SSD writes by roughly 4x, corresponding to about 282 GB/day additional writes.

Zenarmor is using the local SQLite reporting backend. While the engine is running, the SQLite databases and WAL files under:

/usr/local/datastore/sqlite

are continuously updated, especially files such as:

conn_all.sqlite(-wal)
dns_all.sqlite(-wal)
tls_all.sqlite(-wal)
alert_all.sqlite(-wal)
http_all.sqlite(-wal)

What makes this concerning is SSD endurance.

The SSD in this system is rated for 320 TBW. At around 378 GB/day, the rated write endurance would be reached after only about 2.3 years of continuous 24/7 operation.

The additional writes attributable to Zenarmor alone are roughly 282 GB/day, which corresponds to more than 100 TB/year.

I do not actually need historical Zenarmor reporting and would prefer to keep only the filtering/security engine active.

Environment:

OPNsense: OPNsense 26.7.3_8-amd64 FreeBSD 15.1-RELEASE-p3
Zenarmor Engine: 2.6.2
Zenarmor Database: 2.0.26071708
Reporting backend: Local SQLite


Has anyone else on OPNsense measured similar write volumes with Zenarmor?

I am especially interested in whether:

• this level of write activity is considered normal,
• there are OPNsense/FreeBSD-specific factors that significantly amplify these writes,
• there is a supported way to disable or strongly reduce Zenarmor reporting persistence while keeping the engine active,
• or whether this could indicate an issue in the SQLite/reporting pipeline.

[sy]

Hi,

Thank you for the detials. We got your request as a ticket as well and investigating it. We will get back to you as soon as possible.

[Bunch]

Since no one at home right now, the loading of my router is low.
My test is as below:

Zenarmor ON, 15 minutes
127,049,983>127,051,329
=1346 data units
≈688.6MB written in 15 minutes
≈66GB/day

Zenarmor OFF, 15 minutes
127,052,544>127,052,839
=295 data units
≈150.9MB written in 15 minutes
≈14GB/day

Environment:
Base OS: Proxmox 9.2.11
Kernel Version: Linux 7.0.14-15-pve
SSD (hardware): Samsung SSD 970 EVO Plus 500GB
OPNsense VM: (Disk setting only) LVM-Thin, 32GB, Cache=Default (no Cache), Discard=on, IO thread=on, SSD emulation=on
OPNsense: OPNsense 26.7.3_11-amd64 FreeBSD 15.1-RELEASE-p3
Zenarmor Engine: 2.6.2
Zenarmor Database: 2.0.26071708
Reporting backend: Local SQLite 3.53.4,1

[bodenlos]

...

Environment:
Base OS: Proxmox 9.2.11
Kernel Version: Linux 7.0.14-15-pve
SSD (hardware): Samsung SSD 970 EVO Plus 500GB
OPNsense VM: (Disk setting only) LVM-Thin, 32GB, Cache=Default (no Cache), Discard=on, IO thread=on, SSD emulation=on
OPNsense: OPNsense 26.7.3_11-amd64 FreeBSD 15.1-RELEASE-p3
Zenarmor Engine: 2.6.2
Zenarmor Database: 2.0.26071708
Reporting backend: Local SQLite 3.53.4,1

->> What filesystems are you using on the Proxmox host and inside the OPNsense VM?