solved: the culprit appears to be the resolvconf script (which resolvconf)
sha1sum /usr/sbin/resolvconf
4bfee7ac4e855ae48e35ab9ac37ebb8c2d37d210 /usr/sbin/resolvconf
I haven't had an unbound stop message since I commented out
#unbound_conf=/var/cache/unbound/resolvconf_resolvers.conf
in /etc/resolvconf.conf, this on raspberry pi 3b, Raspberry Pi OS Lite, Release date: May 7th 2021.
You can read the full story here
summary of the events I noticed:
stop message in unbound: May 14 06:15:26 unbound[790:0] info: service stopped (unbound 1.13.1)
matching syslog error : May 14 06:15:26 raspberrypi dhcpcd[562]: eth0: part of Router Advertisement expired
setup monitoring in screen: sudo strace -tt -ffo /tmp/trace-unbound -e trace=%signal -p "pidof unbound"
logging script in screen (the topic also describes a method using audit):
#!/bin/bash
file="/home/pi/ps-test.txt"
while :
do
while IFS=" " read -r USER PID CPU MEM VSZ RSS TTY STAT START TIME COMMAND; do
if ! grep -q "${PID}" "${file}"; then
if [[ ( "${COMMAND}" != 'ps aux' ) && ( "${COMMAND}" != *"ps-test"* )]]; then
echo "$(date),${PID},${COMMAND}" | sudo tee -a "${file}"
fi
fi
done < <(ps aux)
done
result in log:
Sun 30 May 18:48:15 CEST 2021,32610,/bin/sh /usr/sbin/resolvconf -a eth0.ra
commenting out the unbound entry in /etc/resolvconf.conf eliminates the unbound stops.
For the first time, since I started monitoring errors and warnings in my logs, the unbound log doesn't contain any errors / warnings.
