I have machines that randomly receive warnings about memory usage spikes exceeding 90%. I created a workgroup and was able to identify the process causing these spikes.
They are IPFire cards with 2GB of RAM. The profile of one of them is:
2GB is a very small RAM ressource, if you use components with automatic update functions. To achieve minimal off-times of the services, it is necessary to download the update data as whole. This is implemented with storage in RAM, either direct or indirect to temp files.
If we want a solution capable to use ‘large’ lists with small RAM, this behaviour is a bug. If we request a minimum memory space of 4GB for using large block lists, temporary high memory consumption is just an ‘issue’.
One aspect should be investigated. If the memory usage reaches 90% the system may use swap space. Is it released afterwards? Are other services urged to use swap?
I only have the Malware and Phishing lists enabled in the DNS Firewall.
I understand that 2GB of RAM might be a small amount, but that’s what we have. These are peak usage spikes. Couldn’t the download speed be optimized so that these devices, even if the process takes longer, don’t require as much RAM?
You know the saying, “time vs. speed.”
Perhaps the downloads are all being attempted at once, which is why it’s taking so long. Perhaps each list could be updated sequentially, and that way, although it might take a little longer, we wouldn’t have this problem. (I don’t know how it’s designed; perhaps it does it sequentially. I don’t know.)
There is a --parallel option that controls how many zones are processed simultaneously. I believe the default value is 1.
You can check the available options with:
zone-sync --help
Usage: zone-sync [OPTION...] ZONE [ZONE...]
--debug Run in debug mode
--parallel[=N] How many zones to process simultaneously
--path[=PATH] Path where to store the zones
--primary[=HOSTNAME] The hostname of the primary to fetch from
--quiet Run in quiet mode
--secure Use a secure transport to transfer the zone
-?, --help Give this help list
--usage Give a short usage message
-V, --version Print program version
It might be worth checking whether the --parallel value is set to more than 1 ?
With DNS Firewall and Intrusion Protection System and web proxy, you will likely not have enough memory with 2 GiB.
With 2 GiB you might even find that running IPS makes the system use swap space regulary.
On my IPFire Prime system with 2GiB I have disabled IPS as the system was regularly using swap and periodically maxing the swap space and then getting an OOM.
You could also try disabling DNS Firewall and enabling urlfilter on the web proxy with the IPFire DBL selected for the source.
That might work for filtering with less memory usage.
zone-sync does have --parallel set to 1 by default. However I suspect that an increase in the --parallel value would require even more ram memory than a setting of 1
Perhaps what you’re running is launching without parameters? In other words, is it doing it by default?
Wouldn’t it be:
/usr/local/bin/update-rpzs
I think it executes this command and with it, the “--parallel=1”. I think. Perhaps this has nothing to do with it and I’m confusing apples and oranges (churras con merinas).
However, the number of worker processes launched remains four in both cases.
The --parallel option does not affect the number of zone-sync processes started.
