Date: Fri, 23 Jan 2009 12:21:32 -0500 From: Scott Ullrich <sullrich@gmail.com> To: "Michael K. Smith - Adhost" <mksmith@adhost.com> Cc: pf@freebsd.org Subject: Re: Issues with PF and 7.1 Message-ID: <d5992baf0901230921h27e78ffndfc2e20d1f7ff6eb@mail.gmail.com> In-Reply-To: <17838240D9A5544AAA5FF95F8D520316056585C1@ad-exh01.adhost.lan> References: <17838240D9A5544AAA5FF95F8D520316056585C1@ad-exh01.adhost.lan>
next in thread | previous in thread | raw e-mail | index | archive | help
On Thu, Jan 22, 2009 at 2:32 PM, Michael K. Smith - Adhost
<mksmith@adhost.com> wrote:
> Hello All:
>
> We are having memory issues with PF and 7.1p2 that we didn't experience with 6.3. Here's what happens.
>
> # pfctl -f /usr/local/etc/pf.conf
> /usr/local/etc/pf.conf:135: cannot define table smtpd_reject_policyd: Cannot allocate memory
> /usr/local/etc/pf.conf:139: cannot define table smtpd_reject_spam: Cannot allocate memory
> pfctl: Syntax error in config file: pf rules not loaded
> # pfctl -t smtpd_reject_policyd -T flush
> 94390 addresses deleted.
> # pfctl -t smtpd_reject_spam -T flush
> 62464 addresses deleted.
> # pfctl -f /usr/local/etc/pf.conf
>
> So, after I flush the tables it loads. Sometimes, however, we get a global out of memory error " DIOCADDRULE: Cannot allocate memory "
>
> Here are my entries from pf.conf for various limits. Everything else is defaults.
>
> set limit tables 500
> set limit table-entries 250000
> set limit { states 1000000, src-nodes 300000, frags 100000 }
> set optimization normal
> set skip on lo0
> set state-policy if-bound
> set timeout interval 300
> set timeout src.track 1200
>
> Finally, the box is using EM interfaces with VLAN's and has 4 Gig of physical RAM. There are two PF boxes in Active/Failover and the errors show up on both, although they seem to show up more often on the Backup device, which seems odd.
>
> Any help would be greatly appreciated.
My first response would have been to set set limit table-entries but
you already did that.
Next thing I would check is a shot in the dark, but worth trying..
What does sysctl vm.kmem_size_max show? Try increasing that size a
bit in loader.conf and see if that helps.
Scott
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?d5992baf0901230921h27e78ffndfc2e20d1f7ff6eb>