mdrabble Posted June 22, 2021 Posted June 22, 2021 For the last couple of days our smootwall S8 box has been running very slow. Memory usage is very often 80% upwards continuously and average load is often quote high. Seeing lots of caution x number of access messages - which is no more than usual. A culmination of all this then forces the box to drop internet connection for a short time for before reconnecting. Before I log a call with smoothwall, anyone any idea to what the cause could be?
DGardiner Posted June 22, 2021 Posted June 22, 2021 Think the memmory usage at 80% is normal ours is the same - although its not an s8.
mdrabble Posted June 22, 2021 Author Posted June 22, 2021 S8 box has just locked up to the point the clock on the LED had frozen. Had to pull the power cable and reboot the box. Never seen a Smoothwall box lockup before. Think it time to start looking for a new box/alternative.
3s-gtech Posted June 22, 2021 Posted June 22, 2021 They do seem to go like this when the disks get old and knackered.
DGardiner Posted June 22, 2021 Posted June 22, 2021 S8 box has just locked up to the point the clock on the LED had frozen. Had to pull the power cable and reboot the box. Never seen a Smoothwall box lockup before. Think it time to start looking for a new box/alternative. If you ring them they will probably replace it - I know we had one with a faulty nic a few years ago that would lockup, had a new one out nbd after they poked at it
mdrabble Posted June 22, 2021 Author Posted June 22, 2021 (edited) Replaced the drives in Feb with Enterprise class SSD drives as box was out of warranty and with logging enabled, thought SSD would allow quicker write times etc.... CPU is a sing i7, 4770S @3.10Hz Quad Core (hyperthreaded to 8) It is about 5 years old Oddly.... since pulling the plug and powering back up memory is about 25% usage. Edited June 22, 2021 by mdrabble
mdrabble Posted June 22, 2021 Author Posted June 22, 2021 If you ring them they will probably replace it - I know we had one with a faulty nic a few years ago that would lockup, had a new one out nbd after they poked at it Sadly box is out of warranty. End of July I'm replacing my HyperV hosts so may look at re-purposing one as replacement smoothwall box
KevinB Posted June 22, 2021 Posted June 22, 2021 Check your firewall settings and the amount of logging it's doing. A couple of weeks ago we were being hit badly by an NTP DDoS attack, and there was so much logging going on that it was grinding the box to a halt with the exact symptoms you describe: Slowing down, halting for a few minutes, picking up again and then dying and needing to be restarted. We had to turn some of the logging off which allowed it to cope with the amount of incoming connection attempts again. Only a temporary measure to get over the attack, but it did get us up and running again.
mdrabble Posted June 22, 2021 Author Posted June 22, 2021 (edited) Checked with ISP and no obvious DDoS at the time - incoming/download traffic was between 50mb - 250mb Only logging I have enabled is any access to 3CX Server and then from BYOD VLAN to internet such as VPN/SMTP access - but I have disabled access to BYOD since yesterday. Since pulling the plug and booting up again, memory usage has been steady at approx 25% Very strange. Next month I am replacing my Hyper-V hosts (HP DL380p Gen8) servers, so may look to reusing one of those to run smoothwall - then will have some decent CPU and Memory and then just need to look at SSD drives for the Gen8 box. Need to check with Smoothwall if they would support the install on 3rd Party Hardware. Edited June 22, 2021 by mdrabble
ChrisC Posted June 22, 2021 Posted June 22, 2021 We saw an update last Wednesday/Thursday that seemed to cause 2 S8s (that we noticed) to become unresponsive. They were both the darker blue caswell appliances with the ports on the front. Do you have auto update enabled?
mdrabble Posted June 22, 2021 Author Posted June 22, 2021 We saw an update last Wednesday/Thursday that seemed to cause 2 S8s (that we noticed) to become unresponsive. They were both the darker blue caswell appliances with the ports on the front. Do you have auto update enabled? Yep have that same appliance but still on Leeds 46
ITGURU Posted June 22, 2021 Posted June 22, 2021 S8 box has just locked up to the point the clock on the LED had frozen. Had to pull the power cable and reboot the box. Never seen a Smoothwall box lockup before. Think it time to start looking for a new box/alternative. Interesting - we had this. Took 2 weeks for smoothwall to remote in but they said because i rebooted the box there would be no logs and to put it down to a one off like a windows BSOD! So we were meant to go with no internet for 2 weeks and not reboot it when it was inaccessible via its ui ?!
ibpalle Posted June 23, 2021 Posted June 23, 2021 (edited) When looking at memory usage, the real indicator is swap usage. On the graph shown, only the yellow part is active memory use - the rest is caching. There is no swap being used at all. High memory usage is perfectly normal and expected behaviour - if the swap grows (you can click on the graph to get a daily, weekly, monthly, yearly overview) then there could be a problem. The caution alert messages you are seeing on the dashboard are triggered by the alert settings you can find in reports - alerts - alert settings. The firewall alerting is likely still set to default values and triggers too much. I'd disable those alerts and enable them when you need to check for things like recurrence of dos attacks or similar. It's a fine alert to use when you know what you are looking for, not so useful as a generic one. Edited June 23, 2021 by ibpalle 1
mdrabble Posted June 23, 2021 Author Posted June 23, 2021 Yep - just checked and memory was the issue Just happy it all working as normal again
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now