Date: Fri, 23 Jan 2009 12:21:32 -0500 From: Scott Ullrich <sullrich@gmail.com> To: "Michael K. Smith - Adhost" <mksmith@adhost.com> Cc: pf@freebsd.org Subject: Re: Issues with PF and 7.1 Message-ID: <d5992baf0901230921h27e78ffndfc2e20d1f7ff6eb@mail.gmail.com> In-Reply-To: <17838240D9A5544AAA5FF95F8D520316056585C1@ad-exh01.adhost.lan> References: <17838240D9A5544AAA5FF95F8D520316056585C1@ad-exh01.adhost.lan>
next in thread | previous in thread | raw e-mail | index | archive | help
On Thu, Jan 22, 2009 at 2:32 PM, Michael K. Smith - Adhost <mksmith@adhost.com> wrote: > Hello All: > > We are having memory issues with PF and 7.1p2 that we didn't experience with 6.3. Here's what happens. > > # pfctl -f /usr/local/etc/pf.conf > /usr/local/etc/pf.conf:135: cannot define table smtpd_reject_policyd: Cannot allocate memory > /usr/local/etc/pf.conf:139: cannot define table smtpd_reject_spam: Cannot allocate memory > pfctl: Syntax error in config file: pf rules not loaded > # pfctl -t smtpd_reject_policyd -T flush > 94390 addresses deleted. > # pfctl -t smtpd_reject_spam -T flush > 62464 addresses deleted. > # pfctl -f /usr/local/etc/pf.conf > > So, after I flush the tables it loads. Sometimes, however, we get a global out of memory error " DIOCADDRULE: Cannot allocate memory " > > Here are my entries from pf.conf for various limits. Everything else is defaults. > > set limit tables 500 > set limit table-entries 250000 > set limit { states 1000000, src-nodes 300000, frags 100000 } > set optimization normal > set skip on lo0 > set state-policy if-bound > set timeout interval 300 > set timeout src.track 1200 > > Finally, the box is using EM interfaces with VLAN's and has 4 Gig of physical RAM. There are two PF boxes in Active/Failover and the errors show up on both, although they seem to show up more often on the Backup device, which seems odd. > > Any help would be greatly appreciated. My first response would have been to set set limit table-entries but you already did that. Next thing I would check is a shot in the dark, but worth trying.. What does sysctl vm.kmem_size_max show? Try increasing that size a bit in loader.conf and see if that helps. Scott
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?d5992baf0901230921h27e78ffndfc2e20d1f7ff6eb>