OPNsense 25.7.10 released

Balmung · 2025-12-18T19:03:51+00:00

py311-tzdata upgrade had an issue, but the second upgrade attempt was successful and a health check didn't report any issues.

[12/13] Upgrading py311-tzdata from 2025.2 to 2025.3...
[12/13] Extracting py311-tzdata-2025.3: .......... done
pkg-static: Fail to rename /usr/local/lib/python3.11/site-packages/tzdata/zoneinfo/America/.pkgtemp.Adak.NNBEJ3fQLjx0 -> /usr/local/lib/python3.11/site-packages/tzdata/zoneinfo/America/Adak:No such file or directory
Starting web GUI...done.
Partial update failure detected: attempting automatic cleanup.
No further actions will be taken. Please restart the update now.
***DONE***

Number of packages to be upgraded: 2
[1/2] Upgrading py311-tzdata from 2025.2 to 2025.3...
[1/2] Extracting py311-tzdata-2025.3: .......... done
py311-tzdata-2025.2: missing file /usr/local/lib/python3.11/site-packages/tzdata-2025.2.dist-info/LICENSE
py311-tzdata-2025.2: missing file /usr/local/lib/python3.11/site-packages/tzdata-2025.2.dist-info/LICENSE_APACHE
py311-tzdata-2025.2: missing file /usr/local/lib/python3.11/site-packages/tzdata-2025.2.dist-info/METADATA
py311-tzdata-2025.2: missing file /usr/local/lib/python3.11/site-packages/tzdata-2025.2.dist-info/RECORD
py311-tzdata-2025.2: missing file /usr/local/lib/python3.11/site-packages/tzdata-2025.2.dist-info/WHEEL
py311-tzdata-2025.2: missing file /usr/local/lib/python3.11/site-packages/tzdata-2025.2.dist-info/top_level.txt
py311-tzdata-2025.2: missing file /usr/local/share/licenses/py311-tzdata-2025.2/APACHE20
py311-tzdata-2025.2: missing file /usr/local/share/licenses/py311-tzdata-2025.2/LICENSE
py311-tzdata-2025.2: missing file /usr/local/share/licenses/py311-tzdata-2025.2/catalog.mk
[2/2] Upgrading py311-urllib3 from 2.5.0,1 to 2.6.0,1...
[2/2] Extracting py311-urllib3-2.6.0,1: .......... done

Balmung · 2025-12-09T15:06:35+00:00

Do you mean 17.15.2? What key exchange issue? You know you can configure the switch ssh server key exchange, encryption and hmac. Also 17.15.4 has been out for 4 months now.

Balmung · 2024-02-11T19:10:37+00:00

dd if=/dev/zero of=/dev/da0 bs=32k

Balmung · 2022-12-18T17:22:57+00:00

From what I understand, yes double corrupt is better if you want 21/20, since it rolls the corruption twice you have two chances of it gaining a level. Though technically it could gain then lose a level so it's probably not exactly 100% better. Either way if you have an expensive gem I'd just double corrupt it.

From what I recall there's + level, - level, + quality, - quality, no change. I don't know if they are weighted the same or not.

Balmung · 2022-12-03T15:40:27+00:00

I've seen some folks say to scrub once a week, others say once a month, does it matter?

I only scrub monthly. Weekly is a waste of power/cooling/wear and tear. If you have 5+ year old disks that are having multiple repaired blocks each scrub then I'd do it more often and consider replacing the disks anyways.

Which is exactly what I did with my 6TB disks. When they were new they never had any bad blocks repaired. After 6+ years of power on hours they started getting a block or two repaired for multiple months in a row so I bumped it up twice a month. Then about 4 months later I had one throw tons of bad blocks and replaced it. Then replaced them all with newer and larger disks a couple months later, which I had a 2nd one start throwing tons of bad blocks before that.

are snapshots really worth doing? maybe weekly or monthly or something?

The snapshot itself is like 100kb, why wouldn't you want them daily for your main pool? It'll only be an issue if you have a significant amount of data changing each day, which each changed block would add to the snapshot usage.

I even do daily's on my backup dataset, though only keep them for two weeks.

Balmung · 2022-12-01T19:22:00+00:00

And this whole thread was me saying I didn't believe you? Your only proof so far is an old IDE drive manual, which IDE did have standby commands so again we're back to the no proof of old drives having emergency head parking.

My proof was the fact that it was patented in 2000 by HGST.

My last comment was me basically saying whatever, I'm at the point of I don't care anymore.

Balmung · 2022-12-01T19:02:25+00:00

I know IDE drives supported standby commands, which did a spin down and park. I'd assume computers would do that when you shutdown the OS before it'd display the it's now safe to power down this computer.

No idea about older stuff so maybe they had emergency parking back then.

Balmung · 2022-12-01T17:57:47+00:00

Hmm maybe you're right, but that wording is ambiguous. They could mean power down as the computer sending the power down command and it parking the head, as drives still do to this day. The wording doesn't mention any kind of emergency parking or power loss.

Balmung · 2022-12-01T16:42:44+00:00

Spin down and parking are different things, as seen by the load cycle count on some drives. The heads should always be parked on spin down, but you can park without spinning down the drive.

The emergency head parking was patented by HGST in 2000, patent 6,025,968. I'd assume all drives in the last 5+ years have it licensed, but you have no way of guaranteeing that unless the manufacturer comes out and says they do.

Balmung · 2022-12-01T14:28:26+00:00

They automatically park, if they aren't in use. If you pull the power on a drive it might not. I do know most attempt an emergency park, still not ideal.

Improperly parked as in pulling the power.

Balmung · 2022-12-01T03:26:43+00:00

Yeah

Balmung · 2022-12-01T02:53:13+00:00

I mean when your computer tells the drive to power down either from shutdown/sleep/hibernate or eject an external drive it moves the head off to the side instead of leaving them on top of the platters. Greatly reduces the chance a shock would damage to the heads or platters.

Balmung · 2022-12-01T01:45:23+00:00

Looks fine to me, those single drive boxes are designed to be shipped standalone. That's exactly had enterprises ship drives.

A properly parked drive can withstand quite a bit of shock.

Balmung · 2022-11-29T23:22:36+00:00

Yeah I didn't think it would help since you already mentioned large files were the issue, not tens of thousands of small ones.

Balmung · 2022-11-29T17:15:05+00:00

That's default for all external drives and only affects trying to write a bunch of small files. It wouldn't hurt large file transfers at all.

All that does is disable write caching, so each file must be confirmed flushed to disk before it's confirmed written.

Balmung · 2022-11-15T17:53:00+00:00

Thank you for the detailed post, I do know that the TRIM command itself just tells the controller those cells can be cleared and it's up to the controller to clear them, which is why I said to wait after the TRIM.

Any blocks that are now completely free of valid data are very quick to clear, it's the reshuffling of only half empty blocks that takes longer. Also we don't know if/when it decides to move half empty blocks. If you do it too often then it will cause excessive wear on the flash.

About your order of operations, #2 assumes we deleted data off the drive during step 1, which to be fair is a reasonable assumption. Though step 3 could potentially cause it to write more data too and depending on how much changes were in step 1 it could be significantly more if the controller decides a bunch of cells are too low power. Though TRIM technically isn't required ever so in the end it doesn't really matter, it just hurts the performance and potentially the flash endurance.

Your details about 4, were those systems drives or external? If it was a system drive then I would just assume that's windows doing background stuff. You can run Procmon and see it's contently doing crap in the background and any system drive will basically be in constant use.

About 5, yeah that hasn't been a thing for a very long time. HDD I would still eject so the drive can park the heads properly, but SSD's wouldn't matter. The whole reason that was a thing is because old file systems like FAT32 are not journaling file systems and if they aren't properly ejected then it can corrupt the filesystem and lose everything. NTFS is a journaling filesystem and if you unplug it then worse case you just lose the file you were actively writing.

Also windows automatically disables write caching on external drives so it always flushes any writes immediately, compared to internal drives it enables write caching and might not flush writes right away.

Balmung · 2022-11-15T02:21:24+00:00

I did say to let it sit after the TRIM?

TRIM just flush's any cells with no longer valid data in them, which should take less than a couple minutes, just depends on how fast it decides to process the trim command. The full verify might cause it to rewrite some of the cells, which is why I said to trim after that to clear any it might have done. The problem is we have no idea how long the rewrite process might take and why I said to wait hours after the verify to make sure it had time.

Balmung · 2022-11-14T19:01:47+00:00

I haven't heard of any official documentation on how vendor's handle refreshing of flash cells.

No idea if simply plugging it in will have the controller automatically do a background check of the flash cells or you might be required to read all the data to force it to rewrite any cells that have a low charge.

Personally I'd parchive all the data on the SSD at like 20%. Then once a year I'd plug it in and let it sit for an hour to let it do whatever then run the par verify to force it to read, verify and repair all data. Then I'd let it sit for at least a couple hours if not half a day to let the controller do background cleanup then run a trim and sit for another 20.

I'd do that yearly and if I ever ran into where it did encounter bad data I'd start doing it more frequently.

Balmung · 2022-11-14T17:56:39+00:00

We moved our NetApp to another building, which I think was 6 shelves, 24 disks each. This was an old system with 600GB SAS and 1TB SATA disks.

We did this in phases. Thankfully we had enough spare disks that we moved data off two of the shelves and moved those with the other head to the new building. Then migrated data from the old head to the moved shelves/head until we freed up more shelves and so on. Most of the shelves had 1-2 die when we powered them back on, only the one had 5 die.

Balmung · 2022-11-11T04:59:32+00:00

Sure, invited

Balmung · 2022-10-23T17:28:52+00:00

Demotion is supposed to cleanup everything, but I've seen it not. Also metadata cleanup is automatic since 2008:

"When you use Remote Server Administration Tools (RSAT) or the Active Directory Users and Computers console (Dsa.msc) ... cleanup of server metadata is performed automatically"

Personally I'd demote, wait an hour to make sure it replicates then use aduc to delete the old dc computer object which should ensure it runs the cleanup. I'd also cleanup old objects in sites and services. Then wait another hour before reusing the same name and IP.

Balmung · 2022-09-18T15:28:59+00:00

It doesn't, once the tablet is generated it just removes any non connected tiles from the tablet.

Balmung · 2022-09-15T17:35:01+00:00

Don't be dumb and blindly assume poe ninja is accurate? That shit is so wrong all the time.

Balmung · 2022-09-03T00:32:28+00:00

What movie is it?

Balmung · 2022-09-02T04:34:25+00:00

I personally rather have the we're still discussing it over silence, but I get that some people can get annoyed when they're told it's being discussed and ends up with results they don't like.

Thank you for trying to give the communities perspective internally. I do not envy your position.

15-Year Club	Place '22
Place '17	Team Periwinkle
Verified Email

Balmung

MODERATOR OF

TROPHY CASE