Sensei on OPNsense - Application based filtering

[mb]

Hi @Rickytr, it's not expected. Does resetting reporting help ? (Sensei -> Configuration -> Reports & Data -> Reset Reporging)

Hi @evergreek, is that you see 100% active/tmp utilization during peak time? or you see no utilization at all?

[evergreek]

mb - it will go above 100% to 104% etc... (in my previous post - the network is quiet).

[mb]

@evergreek, that's not expected. Shoot a PR and let's have a look.

[Mitheor]

Hi @Rickytr, it's not expected. Does resetting reporting help ? (Sensei -> Configuration -> Reports & Data -> Reset Reporging)

I have the same problem. Resetting the reports does not solve the problem.

Live session explorer of connections and TLS works though. It's failing in DNS and Blocks.

Edit. Solved after opening a bug report.

[Mitheor]

Is there any way to check current installed database content (like what urls are included for each category)?

I'd like to test some policies but I need this info  :P

[evergreek]

What are these messages on the logs?

Jul 9 16:28:12    kernel: /usr/local/sensei/output/active/temp: optimization changed from SPACE to TIME

[donatom3]

Hi @Rickytr, it's not expected. Does resetting reporting help ? (Sensei -> Configuration -> Reports & Data -> Reset Reporging)

I have the same problem. Resetting the reports does not solve the problem.

Live session explorer of connections and TLS works though. It's failing in DNS and Blocks.

Edit. Solved after opening a bug report.

Reported bug through the GUI with my logs.

I also have the same problem. I think the issue is the live blocked sessions explorer is now missing all the columns such as start, end, source IP, protocol. Now it shows the columns you expect on the overview page such as "alerts - top blocks" "top remote hosts" Checking all those shows undefined and there is  loaded record counter. So the data is there but the web page for it is missing the columns it needs to show the data.

Live blocked sessions. https://imgur.com/a/B1qt9EP
Here are the columsn in every other live report.  https://imgur.com/a/IKIz8Ec

[mb]

Hi @donatom3,

UI bug which was causing this had been fixed with 1.5.2. But the database entry was still there.
1.6 will auto-detect this issue and fix it during post-install.

Below command should handle this for the time being:

Code Select Expand

echo -n "delete from user_configuration;" | sqlite3 /usr/local/sensei/userdefined/config/settings.db

[mb]

Jul 9 16:28:12    kernel: /usr/local/sensei/output/active/temp: optimization changed from SPACE to TIME

This is a notification from Unix File System (UFS) about its data placement policy. It tells that new priority is back to performance.

This is related to this directory being 100% utilized. We do not expect this to happen under normal traffic conditions. Can you open a PR in case you did not do so?

[evergreek]

mb,

I having a big problem - after upgrading from free -> premium - every couple of days the Sensei instance seems to be killing my internet. I have to login to the shell and kill the sensei process. Then everything starts work again.. a reboot does not fix it .. the problem persists until I kill the process.. i sent in a bug report but I was wondering if you guys had seen this before or someone else on this forum.

[mb]

Hi @evergreek,yes, we received your report. Team is on it. We'll get back to you momentarily.

[DenverTech]

@mb

Having some issues with a new deployment. Previously, we'd had no problems choosing larger sized deployments during install. Based on that, a client hired us to setup a large OPNsense deployment with Sensei. However, it won't let me pick anything larger than "Small II." Specs of the firewall below...it definitely should be able to do far more than Small II. Amusingly, those are the same limitations our 2-core ATOM CPU at another office gets, so something isn't quite right. I've tried uninstalling, reinstalling, rebooting, etc.

CPU: Xeon, 1.9ghz, 6 cores, hyperthreading (12 logical cores)
Memory: 64gb
Score: 131578 (low-end?!)

How can I get Sensei to properly recognize this overpowered beast of a firewall?

[mb]

Hi @DenverTech,

We received several other reports and looking into this.

[DenverTech]

For anyone else following...it appears ubench (used to measure this), isn't reading some Xeon processors properly. Atom CPU = 130,000...Xeon = 130,000. It's measuring single-core oddly. The support team (kudos for the quick solutions) was able to override it and test without the ubench measurement. Despite the claim from ubench that the system couldn't handle anything, it's handling 500+ devices without issue.

Looks like a ubench bug!

[mb]

Hi @DenverTech,

Thanks for the update. Yes, most CPUs look ok, but with some, ubench is producing lower scores.

Team is looking for an alternative solution which could better yield the computing power of the cpu.