Smoothwall Memory usage and load average

[mdrabble]

For the last couple of days our smootwall S8 box has been running very slow.

 

Memory usage is very often 80% upwards continuously and average load is often quote high.

 

Seeing lots of caution x number of access messages - which is no more than usual.

 

A culmination of all this then forces the box to drop internet connection for a short time for before reconnecting.

 

Before I log a call with smoothwall, anyone any idea to what the cause could be?

[DGardiner]

Think the memmory usage at 80% is normal ours is the same - although its not an s8.

 

[mdrabble]

S8 box has just locked up to the point the clock on the LED had frozen.

 

Had to pull the power cable and reboot the box.

 

Never seen a Smoothwall box lockup before.

 

Think it time to start looking for a new box/alternative.

[3s-gtech]

They do seem to go like this when the disks get old and knackered.

[DGardiner]

S8 box has just locked up to the point the clock on the LED had frozen.

 

Had to pull the power cable and reboot the box.

 

Never seen a Smoothwall box lockup before.

 

Think it time to start looking for a new box/alternative.

 

 

If you ring them they will probably replace it - I know we had one with a faulty nic a few years ago that would lockup, had a new one out nbd after they poked at it

[mdrabble]

Replaced the drives in Feb with Enterprise class SSD drives as box was out of warranty and with logging enabled, thought SSD would allow quicker write times etc....

 

CPU is a sing i7, 4770S @3.10Hz Quad Core (hyperthreaded to 8)

 

It is about 5 years old

 

 

Oddly.... since pulling the plug and powering back up memory is about 25% usage.

Edited June 22, 2021 by mdrabble

[mdrabble]

If you ring them they will probably replace it - I know we had one with a faulty nic a few years ago that would lockup, had a new one out nbd after they poked at it

 

Sadly box is out of warranty.

 

End of July I'm replacing my HyperV hosts so may look at re-purposing one as replacement smoothwall box

[KevinB]

Check your firewall settings and the amount of logging it's doing. A couple of weeks ago we were being hit badly by an NTP DDoS attack, and there was so much logging going on that it was grinding the box to a halt with the exact symptoms you describe: Slowing down, halting for a few minutes, picking up again and then dying and needing to be restarted. We had to turn some of the logging off which allowed it to cope with the amount of incoming connection attempts again. Only a temporary measure to get over the attack, but it did get us up and running again.

[mdrabble]

Checked with ISP and no obvious DDoS at the time - incoming/download traffic was between 50mb - 250mb

 

Only logging I have enabled is any access to 3CX Server and then from BYOD VLAN to internet such as VPN/SMTP access - but I have disabled access to BYOD since yesterday.

 

Since pulling the plug and booting up again, memory usage has been steady at approx 25%

 

Very strange.

 

Next month I am replacing my Hyper-V hosts (HP DL380p Gen8) servers, so may look to reusing one of those to run smoothwall - then will have some decent CPU and Memory and then just need to look at SSD drives for the Gen8 box.

 

Need to check with Smoothwall if they would support the install on 3rd Party Hardware.

Edited June 22, 2021 by mdrabble

[ChrisC]

We saw an update last Wednesday/Thursday that seemed to cause 2 S8s (that we noticed) to become unresponsive. They were both the darker blue caswell appliances with the ports on the front.

 

Do you have auto update enabled?

[mdrabble]

We saw an update last Wednesday/Thursday that seemed to cause 2 S8s (that we noticed) to become unresponsive. They were both the darker blue caswell appliances with the ports on the front.

 

Do you have auto update enabled?

 

Yep have that same appliance but still on Leeds 46

[ITGURU]

S8 box has just locked up to the point the clock on the LED had frozen.

 

Had to pull the power cable and reboot the box.

 

Never seen a Smoothwall box lockup before.

 

Think it time to start looking for a new box/alternative.

Interesting - we had this. Took 2 weeks for smoothwall to remote in but they said because i rebooted the box there would be no logs and to put it down to a one off like a windows BSOD!

 

So we were meant to go with no internet for 2 weeks and not reboot it when it was inaccessible via its ui ?!

[ibpalle]

When looking at memory usage, the real indicator is swap usage. On the graph shown, only the yellow part is active memory use - the rest is caching. There is no swap being used at all. High memory usage is perfectly normal and expected behaviour - if the swap grows (you can click on the graph to get a daily, weekly, monthly, yearly overview) then there could be a problem.

 

The caution alert messages you are seeing on the dashboard are triggered by the alert settings you can find in reports - alerts - alert settings. The firewall alerting is likely still set to default values and triggers too much. I'd disable those alerts and enable them when you need to check for things like recurrence of dos attacks or similar. It's a fine alert to use when you know what you are looking for, not so useful as a generic one.

Edited June 23, 2021 by ibpalle

[mdrabble]

 

Yep - just checked and memory was the issue

 

Just happy it all working as normal again