Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Unbound TCP buffer settings not sticky

    Scheduled Pinned Locked Moved pfSense Packages
    85 Posts 5 Posters 23.9k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • B
      bryan.paradis
      last edited by

      @markn62:

      Cleaned the XML of remnant Unbound package info.  The reinstall went well and seems to be working normally now.  Odd though, the install reported 21_1 rather than 21_3.  After install the "Installed Packages" reports 21_3.  And the Unbound Status reports 21_3.  Looks like outgoing-num-tcp: 0 & incoming-num-tcp: 0 are still making it from GUI to XML.

      –-------------------

      Checking for package installation...
      Downloading http://files.pfsense.org/packages/amd64/8/All/unbound-1.4.21_1-amd64.pbi


      version: 1.4.21
      verbosity: 1
      threads: 2
      modules: 2 [ validator iterator ]
      uptime: 51 seconds
      unbound (pid 34067) is running…


      Unbound  Services  1.4.21_3
      Unbound is a validating, recursive, and caching DNS resolver. This package is a drop in replacement for Services: DNS Forwarder and also supports DNSSEC extensions. Once installed please configure the Unbound service by visiting Services: Unbound DNS.

      Great! Wagonza updated the file already so the configuration should be working properly as you see.

      As far as I can see its just the packages list xml has the newer version number and the unbound package xml has the older version number still. Wagonza just needs to update that line.

      1 Reply Last reply Reply Quote 0
      • W
        wagonza
        last edited by

        Yup that's all. Package just needs a rebuild on the package servers as well. Glad to hear all ok markn62.

        Follow me on twitter http://twitter.com/wagonza
        http://www.thepackethub.co.za

        1 Reply Last reply Reply Quote 0
        • M
          markn62
          last edited by

          Not what I was hoping to report.  Thought all was well after the reinstall.  Watched for about an hour and everything appeared normal.  Bout 30 minutes after I walked away Unbound died and would not restart.  Pointed back to the stand-alone unbound service AGAIN.  This is getting so frustrating!

          1 Reply Last reply Reply Quote 0
          • W
            wagonza
            last edited by

            Any logs (both system and package logs) giving an indication as to why?

            Follow me on twitter http://twitter.com/wagonza
            http://www.thepackethub.co.za

            1 Reply Last reply Reply Quote 0
            • B
              bryan.paradis
              last edited by

              @markn62:

              Not what I was hoping to report.  Thought all was well after the reinstall.  Watched for about an hour and everything appeared normal.  Bout 30 minutes after I walked away Unbound died and would not restart.  Pointed back to the stand-alone unbound service AGAIN.  This is getting so frustrating!

              You will need to be much clearer and specific.

              What do you mean it died? Still running but not responding? Crashed/No process?
              What do you see in system.log? Or any other pertinent logs. Better yet pastebin the log so we can look.
              Am I assuming correctly you mean a separate box running unbound when you say stand-alone unbound service?

              Is this a fresh 2.1 installation or a upgrade from prior versions to 2.1?
              If an upgrade what packages do you have installed using pkg_info on the shell?

              1 Reply Last reply Reply Quote 0
              • M
                markn62
                last edited by

                By died I mean the unbound service stopped on it's own after about an hour of normal operation and the watchdog or manual restart wouldn't get it started again.  Yes, stand-alone means a separate box.  It is an upgrade from 2.0 to 2.1.  Pkg_Info reports no packages installed even though there are.  I'm not certain the name and location of the system and package log. I could binpaste the SNMP log if I knew how.  Is that the insert code button?  Bout 100 lines of text probably best not pasted in this post.

                1 Reply Last reply Reply Quote 0
                • B
                  bryan.paradis
                  last edited by

                  @markn62:

                  By died I mean the unbound service stopped on it's own after about an hour of normal operation and the watchdog or manual restart wouldn't get it started again.  Yes, stand-alone means a separate box.  It is an upgrade from 2.0 to 2.1.  Pkg_Info reports no packages installed even though there are.  I'm not certain the name and location of the system and package log. I could binpaste the SNMP log if I knew how.  Is that the insert code button?  Bout 100 lines of text probably best not pasted in this post.

                  http://pastebin.com/

                  /var/log

                  system.log
                  unbound.log? Is there one?
                  /tmp/php_errors.txt

                  what happens when you try to start unbound manually?

                  1 Reply Last reply Reply Quote 0
                  • M
                    markn62
                    last edited by

                    Forum access is with a PC other than what has access to the router logs so it would take me a bit to transfer files around and post here.  For now here is the SNMP; http://pastebin.com/embed_js.php?i=kTkuRnzX  I hope I binpasted correctly using a hyperlink. As mentioned, a manual restart would do nothing.  The service would remain unstarted.

                    A quick look via the GUI edit file I find php_errors.txt is empty even though the SNMP shows some.  The router was rebooted early AM by cron.  The unbound log only has CLOG and some odd symbol after the word.  The system log has plenty and isn't cooperative by remote login.  Large file I suppose.  May have to post the system log this evening.

                    1 Reply Last reply Reply Quote 0
                    • M
                      markn62
                      last edited by

                      Forgot to mention installed packages.  Installed and running fine for a few months other than Unbound are;

                      • Cron

                      • PhpSysInfo

                      • Service Watchdog

                      • SipProxD

                      • Unbound

                      1 Reply Last reply Reply Quote 0
                      • B
                        bryan.paradis
                        last edited by

                        Just grab Winscp and use same credentials as ssh. Just like using a FTP server. Unbound should be complaining somewhere about something.

                        1 Reply Last reply Reply Quote 0
                        • M
                          markn62
                          last edited by

                          Oh it complained all right.  I take it you didn't look at the SNMP file.  First it installed, then ran normally for a bit, then started to lag on the median time, then started with PHP errors, warning about needing an increase in open files.  Then finally that there was no such file or directory.  So in short, the wheels eventually fell off.  Never seen anything like this.  I presume this slow failure occured as more demand hit the unbound package.  I didn't get up at 4AM to see if Unbound would start again after the reboot.  Cleaning up the XML required that I repopulate the Unbound settings via the GUI.  I matched what was in the backup XML so it should have the same configuration as before the upgrade.  The SNMP reports that version 1.4.21 installed, not 1.4.23.  Presume the version reported isn't an issue.

                          1 Reply Last reply Reply Quote 0
                          • B
                            bryan.paradis
                            last edited by

                            check the unbound-control script and look where it is trying to start the binary from. Is the path correct? What is the path really?

                            I am going to be flying for some IT work tonight so I won't be around for a bit maybe! Darn this labor market.

                            1 Reply Last reply Reply Quote 0
                            • W
                              wagonza
                              last edited by

                              What happens if you execute "/usr/pbi/unbound-amd64/sbin/unbound-control start" from the command line?
                              Do you get a warning on 'too many file descriptors requested'?

                              The second issue is that there are two watchdog services running. The Unbound package has its own watchdog (log lines with Unbound_Alarm) called unbound_monitor.sh. So that starts it up Unbound and then so does the watchdog package. Hence why you seeing the "bind: address already in use" error message.

                              You should see unbound-1.4.21_1-amd64 using 'pbi_info'. Doesnt make a difference with _X bit, however I have bumped that on the package servers to avoid confusion in the future. Dont reinstall just yet as the package builders still need to build and create the updated version.

                              Follow me on twitter http://twitter.com/wagonza
                              http://www.thepackethub.co.za

                              1 Reply Last reply Reply Quote 0
                              • M
                                markn62
                                last edited by

                                Thanks guys for all your help on this, much appreciated!

                                Bryan, have a safe flight.  I find;
                                /usr/local/sbin/unbound-control
                                /usr/pbi/unbound-amd64/sbin/unbound-control
                                /usr/pbi/unbound-amd64/.sbin/unbound-control

                                Presume it's the …amd64/sbin...

                                Within this I have;
                                unbound
                                unbound-anchor
                                unbound-checkconf
                                unbound-control
                                unbound-control-setup
                                unbound-host

                                Not sure which file is the script.  The unbound-control file is not readable. The unbound-control-setup has a line;
                                DESTDIR=/usr/pbi/unbound-amd64/etc/unbound

                                Wagonza,
                                I didn't know Unbound had its own watchdog, explains a lot.  Perhaps certain package choices could be removed from the Wachdog service app list for those that will cause a conflict.  If I execute "unbound-control start" I imagine Unbound will halt due to the fact the DNS forwarder is currently enabled and functioning in it's place.  The GUI barks if fwd'r is enabled when unbound is enabled. This box is in active service so I have to be careful not to execute anything that will dump states or crash services.  Can you assure nothing unexpected will happen except a possible warning?

                                Thanks again,
                                Mark

                                1 Reply Last reply Reply Quote 0
                                • W
                                  wagonza
                                  last edited by

                                  Ah ok so you got dnsmasq running again. No worries running that command will cause an error indicating it would not be able to bind to port 53 as its in use.
                                  Other than that it wont cause any harm.

                                  Btw all those binaries you found are correct so nothing looks out of the ordinary.

                                  As for the Unbound watchdog it should probably be removed and leave it up to the Watchdog service to handle. However since Unbound is going into 2.2 a different approach will be looked at.

                                  Follow me on twitter http://twitter.com/wagonza
                                  http://www.thepackethub.co.za

                                  1 Reply Last reply Reply Quote 0
                                  • M
                                    markn62
                                    last edited by

                                    @wagonza:

                                    What happens if you execute "/usr/pbi/unbound-amd64/sbin/unbound-control start" from the command line?
                                    Do you get a warning on 'too many file descriptors requested'?

                                    Wagonza, I get this;
                                    [1393946424] unbound[43135:0] warning: increased limit(open files) from 11095 to 16418
                                    [1393946424] unbound[43135:0] error: bind: address already in use
                                    [1393946424] unbound[43135:0] fatal error: could not open ports

                                    Presume the bind error is because the Dns Forwarder is in use.  I can follow up on that by rechecking for open ports when I reattempt to start the Unbound pkg again.  But what about the increase open files limit?  Never seen this error message before.

                                    1 Reply Last reply Reply Quote 0
                                    • B
                                      bryan.paradis
                                      last edited by

                                      The limit warning is because the normal process resource limits are being extended by unbound further than system has set them to as default. It has done so successfully.

                                      This is driven by outgoing range and number queries. Though you're unbound is trying to take a ton of resources. 16000+ Try stripping out your custom outgoing range and number query options maybe. If you Google a bit your limit increase is oddball. Might have to do with multiple lines being the same.

                                      Are these settings matching your other stand alone?
                                      If so how much ram does it use? Do you see warnings?
                                      What is your stand alone ulimit set to?

                                      You could try to remove the duplicate default settings in the script that generates the unbound configuration file. It may not handle duplicates well and is why we see strange issues.

                                      1 Reply Last reply Reply Quote 0
                                      • M
                                        markn62
                                        last edited by

                                        Thanks Bryan for the explaination.  I have 8GB ram serving ~200 PC users.  An outgoing range of 900 on a single thread works fine on a stand-alone Unbound service in a 2G P4 box w/ 2G ram.  The GUI doesn't allow setting the outgoing range but does so automatically at the 8192 number, as I recall.  Setting a custom outgoing range in the Unbound Options causes the service to not start, or at least it did.  This was my original concern when I first tried the Unbound package last year using my script from the P4, unbound has limited tuning as a package.

                                        If it's automatic then perhaps I shouldn't be concerned.  I'll plan an early AM restart of Unbound without a separate watchdog service active and see if the wheels stay on.  The only other post-upgrade change made was incoming/outgoing buffers from 10 to 0 now that they reflect in the XML.

                                        1 Reply Last reply Reply Quote 0
                                        • W
                                          wagonza
                                          last edited by

                                          @Markn62 follow @bryan.paradis' advice. You can try reduce the number of buffers it uses and other resources.
                                          The outgoing-range is a bit high and that value is automatically calculated based on Unbound docs.
                                          So possibly the maths is wrong….

                                          ermm nope for some reason it has the value 8192 hard coded o_0.

                                          Will fix that

                                          Follow me on twitter http://twitter.com/wagonza
                                          http://www.thepackethub.co.za

                                          1 Reply Last reply Reply Quote 0
                                          • B
                                            bryan.paradis
                                            last edited by

                                            @markn62:

                                            Thanks Bryan for the explaination.  I have 8GB ram serving ~200 PC users.  An outgoing range of 900 on a single thread works fine on a stand-alone Unbound service in a 2G P4 box w/ 2G ram.  The GUI doesn't allow setting the outgoing range but does so automatically at the 8192 number, as I recall.  Setting a custom outgoing range in the Unbound Options causes the service to not start, or at least it did.  This was my original concern when I first tried the Unbound package last year using my script from the P4, unbound has limited tuning as a package.

                                            If it's automatic then perhaps I shouldn't be concerned.  I'll plan an early AM restart of Unbound without a separate watchdog service active and see if the wheels stay on.  The only other post-upgrade change made was incoming/outgoing buffers from 10 to 0 now that they reflect in the XML.

                                            Unbound works well for others with 8192 default.
                                            Unbound not working for you.
                                            Try running without changing outgoing.

                                            If that works having dupliccate of that setting in the conf file may be the issue. Remedy d be to edit the. Inc

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.