On Mon, Nov 30, 2009 at 4:15 PM, Jostein Elvaker Haande <[email protected]> wrote: > On Mon, Nov 30, 2009 at 9:43 PM, Chris Buechler <[email protected]> wrote: >> On Mon, Nov 30, 2009 at 5:27 AM, <[email protected]> wrote: >>> Well, I uninstalled the Snort plugin after reading your mail. That may have >>> been the cause. I guess a pentium III 900MHz just can't handle snort + PHP. >> That's more than enough, must be some sort of problem with the Snort >> package. Haven't seen that personally, we are doing some work on the >> Snort package right now (primarily for 2.0), may run into or resolve >> that in the process. > > I've seen this on three production boxes now, and also seen two users > that popped into the IRC channel mentioning the same. > > The problem seems to be with snort and the option(s): > > - Convert Snort alerts urls to clickable links > - Associate events on Blocked tab > > If either or both are enabled and you enter the "Blocked" page, the > page starts to load and seemingly stops loading. If you fire up top on > a console, you see that PHP consumes 100% CPU. > > At work, we have a decent Dell R200 (Xeon based CPU and 4GB RAM) that > spikes with 100% CPU usage on two cores. The execution of the PHP > script doesn't seem to time out, and I have to manually kill the PHP > processes to get things back to normal. Switching off the above > options and then going back into the "Blocked" page, and everything is > back to normal. >
Thanks for the info on replicating, I opened a bug ticket. http://redmine.pfsense.org/issues/show/200 --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected] Commercial support available - https://portal.pfsense.org
