Testresults: EFW doesn't recognize more dan 3 Gb RAM, H67 chipset/core i5 works

[Guest]

[sourcefinder]

I installed EFW 2.4.1 on an Asus P8H67-M mainboard with an Intel Core i5 2500 CPU and 4 Gb of RAM (just for testing). The CPU is recognized properly, but EFW only recognizes 3 Gb RAM instead of 4 Gb. This topic is meant to inform EFW users, but of course i'm curious for solutions!

Hope this will be of some help for the community.

[mrkroket]

It can handle more than 3GB RAM.... with the correct kernel.
You need a PAE kernel, it had one on 2.4.0 version (not sure about 2.4.1).
I'm using 4GB RAM in my 2.4.0 (kernel 2.6.27.19-72.e25PAE).

[sourcefinder]

Thanks, mrkroket. I will find out where to find this PAE kernel and try it after my holiday. I was using 2.4.1, so this hasn't got this new kernel. Unfortunately my testsystem had to go. I hope you can also give me some information on my next question:

How 'memory hungry' is  EFW, used with proxy, antivirus, spamfilter and IPS? When I look at the hardware on the Endian site, only the largest model has got 4 Gb and is used for medium/large organisations. On the other hand I can see that my own EFW (Celeron 440) already uses 75% of it's 1 Gb memory with only two regular users. Does this mean that at 10 users you will need 4 Gb and with 20-30 users you will need 8 Gb...?

[mrkroket]

Kernel PAE usually was an optional update of the efw-upgrade command. You did an efw-upgrade and then an smart install kernel-PAE.
This was on 2.4.0, not sure about 2.4.1

Memory and CPU usage depend on many factors.

I have several EFW on production, with average good performance:

Main Firewall: Quad Core, 4GB RAM, 6 Gigabit NIC's (with VLAN and bonding)
-2 WAN's totalling 50Mbps
-MailServer hosted (about 200 accounts)
-Remote Desktops hosted (about 20 users)
-IPS enabled
-Traffic Monitoring enabled
-Firewall enable with many rules
-HTTP Proxy enables with tons of rules.
-HTTP Proxy cache with 800MB mem cache
-About 130 local users that uses Web
-QoS enabled
-3 OpenVPN VLANs to remote Endians
-Antivirus disabled. I don't like it, it usually wrecks the whole thing. Maybe you can set to 1MB scan

In that case CPU usage usually is 8% and RAM goes to 2GB usage.

Memory usage is not lineal. I have another EFW with Dual Core and only 1GB, serving another office (about 60 workers). Their Mem usage is what follows:
PID USER      PR  NI  VIRT  RES  SHR S %CPU %MEM    TIME+  COMMAND
4369 squid     15   0  582m 359m 1956 S    0 36.0  31:34.57 squid
4364 clamav    18   0  118m 105m  800 S    0 10.6   0:57.97 clamd
22718 clamav    18   0  102m  98m  932 S    0  9.9   0:06.67 havp
23237 root      15   0  108m  82m 1584 R    1  8.2   0:41.76 snort

To reduce mem usage you should: Lower HTTP Proxy Mem cache, reduce Antivirus scan Size (to 1MB), and consider using traffic monitoring only when needed.
Firewall doesn't care about number of users, but they are more dependant of # of connections and bandwith.

[sourcefinder]

I was on holiday for a few weeks, therefore my slow reaction.  Thanks for the information; answers a lot of questions for me. So 4 Gb should be more than sufficient for a lot of networks, but when you don't configure it well/users are going to experiment with options more memory would be a perfect option, the more while extra memory doesn't cost a lot these days.  According to the test by Shalib2 a PAE kernel can't be installed on version 2.4.1. So back to 2.4.0 for bigger networks!