Lately my system has been freezing and completely unresponsive. ctrl+alt+backspace, reisub, nothing works and I have to hard reset. I found some logs, syslog, and have posted a few leading up to the freeze. They’re all from ProtonVPN (I’m on beta). I’m hoping there’s something I can do without just not using ProtonVPN, assuming proton is the culprit. Can anyone make sense of this?

I don’t know how much of this info should be private so I redacted some, timezone, pc name, mac, ports.

2025-12-12T11:09:27.835680TIME MYPC protonvpn-app[4792]: 2025-12-12T15:09:27.835612+00:00 | proton.vpn.local_agent/port_forwarding.rs:225 | INFO | Receiving Response { version: 0, operation: 130, response_code: 0, gateway_epoch_seconds: 4116943, internal_port: REDACTED, external_port: REDACTED, lifetime_seconds: 60 }
2025-12-12T11:09:28.257753TIME MYPC protonvpn-app[4792]: 2025-12-12T15:09:28.257690+00:00 | proton.vpn.session.utils:112 | INFO | API:RESPONSE | '/feature/v2/frontend'
2025-12-12T11:09:28.258827TIME MYPC protonvpn-app[4792]: 2025-12-12T15:09:28.258799+00:00 | proton.vpn.core.refresher.feature_flags_refresher:94 | INFO | Next feature flag refresh scheduled in 1:39:23.178147
2025-12-12T11:09:32.026373-04:00 MYPC kernel: [UFW BLOCK] IN=proton0 OUT= MAC= SRC=REDACTED DST=REDACTED LEN=60 TOS=0x00 PREC=0x00 TTL=54 ID=30062 PROTO=TCP SPT=REDACTED DPT=REDACTED WINDOW=29200 RES=0x00 SYN URGP=0 
2025-12-12T11:32:17.244594TIME MYPC systemd-modules-load[957]: Inserted module 'lp'

Edit: The log includes the first entry after rebooting at 11:32. The system clock froze at 11:09:55, 22 seconds after the kernel entry.

Edit 2: There a whole bunch of entries prior to the ones I posted, all very similar mentioning proton and most with UFW block, for example:

2025-12-12T11:07:12.127370-04:00 MYPC kernel: [UFW BLOCK] IN=proton0 OUT= MAC= SRC=REDACTED DST=REDACTED LEN=52 TOS=0x00 PREC=0x00 TTL=116 ID=9565 PROTO=TCP SPT=REDACTED DPT=REDACTED WINDOW=65535 RES=0x00 SYN URGP=0

I’m realizing now the reference to Proton is just my connection.

Edit 3: If I’m reading this stuff correctly, a bunch of UFW BLOCK happened before the crash. Assuming SRC is the source IP, they’re all different. Assuming DPT is the port they’re trying to access, they’re all the same ProtonVPN port. There are more but between 11:01:32 and 11:09:32 there were 24 UFW blocks.

Edit 4: Froze again while messing around with my firewall. I had installed Firewall Configuration a little while ago to figure out some server stuff. No idea if it had anything to do with it, but I’ve deleted that and reset my ufw. I found one post online talking about firewall packets freezing their Arch system, so I’m wondering if that’s the root cause, I’m not great with network stuff haha. I’ve also installed fail2ban to block multiple ip attempts. Only weird thing now is previously my firewall had port numbers and stuff, and now it’s 0s like:

Allow incoming 0.0.0.0 ssh (0/TCP)

Allow incoming :: ssh (0/TCP)

Allow incoming 0.0.0.0 dhcpv6-client (0/TCP) etc.

No idea if that’s normal

  • data1701d (He/Him)@startrek.websiteEnglish
    3·
    12 hours ago

    I don’t think it’s ProtonVPN, at least not directly, as those happened over 20 minutes before the crash (I’m assuming it happened somewhere around 9:32:30)

    That last one looks really odd, and I’m wondering what that kernel module is used for. I’m looking around real quick.

    EDIT: Looks like it’s for line printers. I’m trying to think why your kernel would randomly load that. Can we see the contents of the following?:

    • /etc/modules-load.d/modules.conf
    • /usr/lib/modules-load.d/modules.conf
    • /usr/local/lib/modules-load.d/modules.conf (if it exists)
    • /run/modules-load.d/modules.conf (if it exists)

    Also, can you give us more information about your hardware, just to be sure?

    • Jack_Burton@lemmy.caOP
      2·
      11 hours ago

      Should have mentioned I included the last log entry from when I got it back up. The clock froze at 11:09:55, 22 seconds after the kernel log entry. I booted back up at 11:32.

      -/etc/modules-load.d/modules.conf

      # /etc/modules is obsolete and has been replaced by /etc/modules-load.d/.
# Please see modules-load.d(5) and modprobe.d(5) for details.
#
# Updating this file still works, but it is undocumented and unsupported.

      • /usr/lib/modules-load.d/modules.conf This does not exist. In that directory I have /usr/lib/modules-load.d/fwupd-msr.conf and /usr/lib/modules-load.d/osspd.conf

      • The other two do not exist.

      • OS: Ubuntu 24.04 noble

      Kernel: x86_64 Linux 6.14.0-37-generic

      Uptime: 13m

      Packages: 3944

      Shell: bash 5.2.21

      Resolution: 5250x2160

      DE: KDE 5.115.0 / Plasma 5.27.12

      WM: KWin

      GTK Theme: Materia-dark [GTK2/3]

      Icon Theme: breeze-dark

      CPU: 11th Gen Intel Core i5-11400F @ 12x 4.4GHz [62.0°C]

      GPU: NVIDIA GeForce RTX 3060

      RAM: 5560MiB / 15860MiB

      • data1701d (He/Him)@startrek.websiteEnglish
        2·
        9 hours ago

        Alright then. That probably eliminates the lp thing. Can I ask: what journalctl command (or logging command in general, if not journalctl) did you use? I’d recommend giving the results of journalctl -b -1 -p 3 and dmesg.

        Also, it’d probably be a good idea to tell us what ports are getting blocked; that shouldn’t be personally identifying in any way. After doing research on what those ports are and what ProtonVPN requires, try experimenting with unblocking some of them if you can; a blocked port shouldn’t crash your system, but it’s worth a shot.

        I might also recommend looking at a task manager, just to make sure some application isn’t taking up all your memory and causing the system to freeze.

        Finally, take a look at your CPU temps in case this is some kind of cooling failure.

        • Jack_Burton@lemmy.caOP
          1·
          8 hours ago

          For the log? I just opened syslog in /var/log. Running journalctl -b -1 -p 3 only goes back to around 14:10, right after booting from the last freeze. dmesg just spits out a ton of the same UFW BLOCK entries, usb connections and such, and only one error that says usb 1-2.4.1.1.3: clock source 41 is not valid, cannot use (I have no idea if this is new or just always was). The first freeze happened yesterday morning, frozen sometime overnight when I wasn’t even using the PC, but I didn’t know about logs or anything so had no idea what to check.

          The ports are whichever port is currently active in ProtonVPN’s port forwarding.

          I saw another Lemmy post earlier about task managers and installed glances earlier this morning. Unfortunately it wasn’t running at the first freeze but was at the second, and didn’t look like anything was amiss to me. I have had issues in the past though with running too many things at once, like a browser with open tabs, music player, and video editor at the same time eating RAM like crazy. I’ve since created a swap file and I can’t remember the other thing, but it’s meant to shut down the most memory hungry app before things get sluggish.

          This type of freezing up is new though, nothing works, and I’ve left it for hours with no change. Previous freezes from eating RAM resulted in a slow moving cursor and resolved in about 20 mins. I also made a lot of adjustments for audio recording months ago that I’d really rather not reinstall the OS and lose, mostly since I’m new to Linux and don’t remember how I got it working haha.

          CPU temp seems to stay pretty constant around 45-48 degrees.

          • data1701d (He/Him)@startrek.websiteEnglish
            2·
            8 hours ago

            If you scroll down in journalctl, it can go later in time. Also, you can check different boots by changing the b parameter, with -b 0 being the current boot, -b -1 being the previous boot, b -2 being the boot before that, etcetera.

            For UFW, I’d just try unblocking the Proton ports if it says they’re blocked in Proton settings. Also, check to make sure you don’t have two firewalls installed; while this once again shouldn’t crash the system, my PC did some very weird things when both UFW and firewalld were installed.

            • Jack_Burton@lemmy.caOP
              1·
              7 hours ago

              OK! So I must have rebooted more than I remembered. Going back to -4 gave me the errors from the first freeze today:

              Dec 12 11:09:36 MYPCNAME kernel: BUG: unable to handle page fault for address: ffffaa5cf71f6380
Dec 12 11:09:36 MYPCNAME kernel: #PF: supervisor read access in kernel mode
Dec 12 11:09:36 MYPCNAME kernel: #PF: error_code(0x0000) - not-present page

              Going back to -2 I got the errors prior to the second freeze:

              Dec 12 14:09:12 MYPCNAME kernel: BUG: unable to handle page fault for address: 000066fd90033180
Dec 12 14:09:12 MYPCNAME kernel: #PF: supervisor read access in kernel mode
Dec 12 14:09:12 MYPCNAME kernel: #PF: error_code(0x0000) - not-present page
Dec 12 14:09:12 MYPCNAME kernel: Fixing recursive fault but reboot is needed!
Dec 12 14:09:12 MYPCNAME kernel: BUG: scheduling while atomic: plasma-browser-/162281/0x00000000

              Just want to say how much I appreciate you taking the time, I’m learning a lot with this, thank you.

              Edit: Looks like it may be related to memory issues OOM? I did install something regarding oom awhile back but I don’t remember what it was. I’m seeing nohang recommended tho

              Edit 2: I check my running services, the other one was earlyoom. I’ve removed earlyoom and installed nohang. Hope I’m on the right track.