Memory swap usage 9.1GA and UTM220

RE: Memory swap usage 9.1GA and UTM220

gilipeled — Wed, 05 Jun 2013 09:35:47 GMT

Hi ,

The only news are that there are no news for now
The cause of this issue is SNORT.
And for now there are no good news yet.
I myself suffer from this issue with 2 UTM of 525.

All my best .

Gilipeled

RE: Memory swap usage 9.1GA and UTM220

caprocha — Wed, 05 Jun 2013 09:32:41 GMT

Any news on the pattern update to solve this problem ?

RE: Memory swap usage 9.1GA and UTM220

gilipeled — Fri, 31 May 2013 06:33:07 GMT

Hi ,

The issue of the swap is not solved yet.
The chase is snort and there is nothing to do for now.
A new snort will be pushed in the next few weeks with a pattern up2date.
Sorry but this is the situation for now.
I am in touch all the time with the support and dev team , that's the answer for now :-(

All my best

RE: Memory swap usage 9.1GA and UTM220

Siarom — Fri, 31 May 2013 06:19:20 GMT

The Memory overflow does not seem to be a problem or Proxy UTM220, have some UTM120, only the Firewall service set, and even then, there is the use of swap.

RE: Memory swap usage 9.1GA and UTM220

stealthmatt_01 — Thu, 30 May 2013 19:50:42 GMT

@Balfson, we have replaced the UTM 120 with a 220 and noticed a significant performance increase. Pages load normally and no issues. The 120 is under powered. We do have https scanning and web cat filtering enabled as well as various URL filters to allow different sites.

In relation to the RAM, I am not sure because iv always upgraded ours when we purchase it to 4GB straight away and never looked back. Our page is consistently non existent. At present for the last 3 days since reboot its only grown to 1.95% and thats with MEM web filtering.

I recommend anyone to bite the bullet and just upgrade to 4GB.... you can always change the RAM back to 2GB if you need to log a support job. However, as I mentioned previously we have logged a few support calls and never been asked about it, so its not really a concern anyways.

RE: Memory swap usage 9.1GA and UTM220

BAlfson — Thu, 30 May 2013 19:25:18 GMT

Not there either. I have a Rev.5 220 client with 126 active IPs, Full Guard with Intrusion Prevention, Web Filtering and Endpoint active.

Today's threat status:

Firewall:		25 272 packets filtered
IPS:		19 attacks blocked
Antivirus:		0 items blocked
AntiSpam:		0 emails blocked
AntiSpyware:		0 items blocked
Web Filter:		3 264 URLs filtered
WAF:		0 attacks blocked
Endpoint:		36 attacks blocked

CPU Usage (today):

Maximum	Minimum	Average	Last
33.28%	4.60%	10.81%	13.18%

Like I said, I don't know what the problem is that others are having.

Cheers - Bob

RE: Memory swap usage 9.1GA and UTM220

tjhia — Thu, 30 May 2013 18:27:43 GMT

Hi Luckman, if by coincidance your http proxy is on, or if you are running in windows domain environment, try get the users to NOT use the http proxy from their browser (automatic configuration setting).

in my ASG220 2GB RAM, every random while the snort will hit 100% and i notice a linear relationship with high swap file. In my scenario, disable http proxy (via Active Directory and redirect http proxy as automatic configuration) is a success as memory leak, high swap file and snort 100% has never happened for almost 3 weeks period now.

I have not tried upgrading the RAM as yet, since our product is still under the warranty. I will wait and see if there is any stable release via up2date that can permanently fix this issue.

RE: Memory swap usage 9.1GA and UTM220

Siarom — Thu, 30 May 2013 17:22:11 GMT

I don't know what the problem might be. I have more than a few customers with a Rev.5 120 and don't see that, Matt. I just checked one that has Full Guard with IPS, Email, Web FIltering and Application Control active with 54 users. The stats from the last 24 hours:
Firewall:		49 377 packets filtered

IPS:		0 attacks blocked

Antivirus:		0 items blocked

AntiSpam:		1 261 emails blocked

AntiSpyware:		0 items blocked

Web Filter:		11 832 URLs filtered
CPU Usage:
Maximum	Minimum	Average	Last

64.85%	9.50%	14.87%	12.81%
Cheers - Bob

The problem then occurs only with UTM220 REV5 and 2GB of memory?

RE: Memory swap usage 9.1GA and UTM220

BAlfson — Thu, 30 May 2013 16:44:19 GMT

I don't know what the problem might be. I have more than a few customers with a Rev.5 120 and don't see that, Matt. I just checked one that has Full Guard with IPS, Email, Web Filtering and Application Control active with 54 users. The stats from the last 24 hours:

Firewall:		49 377 packets filtered
IPS:        		0 attacks blocked
Antivirus:		0 items blocked
AntiSpam:		1 261 emails blocked
AntiSpyware:		0 items blocked
Web Filter:		11 832 URLs filtered

CPU Usage:

Maximum	Minimum	Average	Last
64.85%	9.50%	14.87%	12.81%

Cheers - Bob

RE: Memory swap usage 9.1GA and UTM220

stealthmatt_01 — Thu, 30 May 2013 15:21:21 GMT

If you are revision 4 of the 120 you can upgrade to 2GB max. However the 120 is poor and I wouldnt recommend to anyone. With 20 users we noticed web pages taking 2 to 10 seconds to load and only ips and web filtering enabled.

We are now just going to use it for a guest network which will only have about 3 or 5 users at any one time.

RE: Memory swap usage 9.1GA and UTM220

Siarom — Thu, 30 May 2013 07:21:30 GMT

snort and http proxy asre very ram intensive. There's only so much you can do with a codebase that requires the amount of ram snort and http proxy do. Swap is going to be utilized in a sub 4 gig environment with both on...the leaks need to get fixed but the real fix is to make the minimum 4 gigs of ram.

After upgrading my UTM220 to 4GB (2x2GB), swap usage became insignificant. I agree with William, the real fix is to update the boxes.

Before, with 2GB default swap usage is intense.

Sophos UTM will ensure that work well with only 2GB? While it does not, I have to continue with 4GB Ram. So I think there should be no loss of warranty

How should in UTM120? With only 1GB, proxy should not handle even 20 users with this memory behavior.

RE: Memory swap usage 9.1GA and UTM220

William Warren — Thu, 30 May 2013 06:58:48 GMT

snort and http proxy asre very ram intensive. There's only so much you can do with a codebase that requires the amount of ram snort and http proxy do. Swap is going to be utilized in a sub 4 gig environment with both on...the leaks need to get fixed but the real fix is to make the minimum 4 gigs of ram.

RE: Memory swap usage 9.1GA and UTM220

gilipeled — Thu, 30 May 2013 00:57:59 GMT

Hi ,

The most problematic is the snort behavior and it will be fixed in the next few weeks with a pattern up2date.
I am working closely on that with the support and dev team .
We have installed few monitoring and debugging tools in my environments to help solving that out.
I will inform when there will be good news.
The most problematics issue appears with system that don have lots of ram.
I have a very big environment with very strong appliances so it can handle it without a problem and it will help to solve that I hope.

All my best

RE: Memory swap usage 9.1GA and UTM220

luckman212 — Wed, 29 May 2013 21:17:59 GMT

Bob
Thanks for trying to help. It is an ASG220 appliance (in production) - not a VM etc. I have for now disabled both IPS as well as Web Filtering as both of them seem to have issues with 9.1 (even the most recent 9.101-12) with both 'httpproxy' and 'snort_inline' processes spinning wildly out of control pegging the CPU at 100%.

Now CPU usage is back to

RE: Memory swap usage 9.1GA and UTM220

BAlfson — Wed, 29 May 2013 16:41:23 GMT

Luckman, if this is your own PC and not a Sophos Appliance, first, try as root, cc set ips num_instances 1

Did that help?

Cheers - Bob

RE: Memory swap usage 9.1GA and UTM220

luckman212 — Wed, 29 May 2013 10:30:13 GMT

Ok, will try that again. As I posed before I remember trying that a few days ago and even though I had disabled IPS somehow snort_inline was still running and taxing the CPU.

RE: Memory swap usage 9.1GA and UTM220

gilipeled — Wed, 29 May 2013 10:24:12 GMT

Just disable intrusion preventation.

RE: Memory swap usage 9.1GA and UTM220

luckman212 — Wed, 29 May 2013 10:05:24 GMT

How can I fully disable Snort for now?

RE: Memory swap usage 9.1GA and UTM220

gilipeled — Wed, 29 May 2013 10:04:41 GMT

Snort still have problems.

Will be fixed in the next few weeks with a pattern UP2date.

All my best

RE: Memory swap usage 9.1GA and UTM220

luckman212 — Wed, 29 May 2013 09:59:57 GMT

I'm still running into CPU usage issues on 9.101-12 which we installed last night. It's snort maxing out the cpu, getting locked up on something. Disabling IPS "fixes" it for a few minutes but then even if I leave IPS disabled somehow snort_inline process still comes back some time later and again maxes out the CPU at 99%. RAM usage is around 70%. I don't know where else to turn, we are kind of just keeping an eye on it during the day and manually killing off these processes when they spin out of control but that is not a long term solution.

RE: Memory swap usage 9.1GA and UTM220

maygyver — Wed, 29 May 2013 06:05:21 GMT

With 9.1 I have no swap Problem, but a process wait Problem off 80-90%. (on UTM220)

Seems to be HA.

RE: Memory swap usage 9.1GA and UTM220

gilipeled — Wed, 29 May 2013 03:48:19 GMT

Ok my friends.

I am abut sad to inform , swap issue not solved yet.
It's a bit better cause few MEM leaks were fixed.
There is a snort issue making swap to grow and is is the same issue since 9.006 .
There is no fix at the moment for that .
The dev are working on it and I have been told that a new snort will be pushed in a pattern in the next weeks.
If there will be something new I will inform.

All my best.

RE: Memory swap usage 9.1GA and UTM220

gilipeled — Tue, 28 May 2013 15:24:13 GMT

Hi ,

Maybe It's not pushed yet but you can Download it and install it manually .

Ally best

RE: Memory swap usage 9.1GA and UTM220

luckman212 — Tue, 28 May 2013 15:05:10 GMT

For some reason the new 9.101-12 isn't showing up in my "up2date" screen yet. Even though yes I do see the image on the ftp server. I guess I can manually update. Need a fix bad, our ASG220 is choking on snort bigtime

RE: Memory swap usage 9.1GA and UTM220

tjhia — Mon, 27 May 2013 19:31:25 GMT

Hi Gilipeled,

Thanks for the updates and hopefully this memory leak issue is resolved. in our case, SSL Scanning has always been turned off and memory leak culprit comes from http web-proxy via astaro.

Our environment is pretty small with average concurrent connections at 670 and average users in the office at once at about 50.

from the several members posts, i can take deduction that memory leak particularly swap memory do happen, particularly from ASG220 with 2 GB RAM but the leak can be caused from different areas (SSL, web proxy, cache, etc). Hopefully 9.101 also check and address memory leaks from various areas mentioned above.