Opnsense GUI very slow after modify IDS rules

[Azgar1998]

Hello, I have lastest opnsense version 23.7.8 (september 2023)

• I activated suricata: no slowness observed
• I downloaded all the suricata rules: no slowness noted
• Deactivation of all IDS web_app_specific rules: (5000 rules): slowness of the interface noted
• Reactivation of IDS rules previously deactivated for a return to normal: slowness still observed

On the Opnsense console, when I look at the resources used (top command) I notice that PHP-GUI and PHP consume resources abnormally and this has an impact on the use of network resources (ping of more than 1 MS from time to time when I perform an operation, for example deactivate a meerkat rule)

the more I modify the rules, the more resources the PHP and PHP-CGI process takes (activation or deactivation of ids rules)

The suricata service is stable at between 0.38% and 0.40% overall usage.

I made a backup from the opnsense interface before and after configuring the IDS rules. when I restore only suricata from backup where it was not active, the php and php-cgi processes return to normal

thanks for your help.

[OPNsense-bot]

Thank you for creating an issue. Since the ticket doesn't seem to be using one of our templates, we're marking this issue as low priority until further notice.

For more information about the policies for this repository, please read https://github.com/opnsense/core/blob/master/CONTRIBUTING.md for further details.

The easiest option to gain traction is to close this ticket and open a new one using one of our templates.

[Azgar1998]

Hello, the slowness is generated by the manipulation of the rules. when I restore suricata with its original configuration the problem disappears

[OPNsense-bot]

This issue has been automatically timed-out (after 180 days of inactivity).

For more information about the policies for this repository, please read https://github.com/opnsense/core/blob/master/CONTRIBUTING.md for further details.

If someone wants to step up and work on this issue, just let us know, so we can reopen the issue and assign an owner to it.