Unbound seems to be restarting frequently
-
Most if not all of the problems people are having is caused by bad settings.
I get this alot with people where they don't read or follow directions or advice fully and go their own way with part of the setup and then blame the hardware/software/instructions when things don't work as they should. Pretty much this entire thread at this point is totally just people shooting themselves in the foot. Unbound is fine.
I disagree. I have followed the direction meticulously and studied the problem deeply. Forwarder is fine, Unbound is not.
-
You only think you have followed directions. At some point you will discover some little something you have either changed or not done correctly.
-
You only think you have followed directions. At some point you will discover some little something you have either changed or not done correctly.
Nope, the problems are real.
-
So why is it not broken for me at a dozen places? Does it just like me better than you?
-
So why is it not broken for me at a dozen places? Does it just like me better than you?
Oh come on, you're not really that dense, are you? A number of people are reporting this problem here and elsewhere.
The fact that some, not all, experience issues is due to differences in hardware, how pfSense is used, etc.
This is the nature of many bugs, of course, and if you don't agree with this, you're either dense or just trolling. Which is it?
-
So why is it not broken for me at a dozen places? Does it just like me better than you?
Why is it that if it's not a problem for you then you will defend it all the way until you become offensive to others? It's obvious, based on the logs, that there is a problem. This is very true to most of your posts. Instead of trying to help others, you choose to be sarcastic and offensive.
-
You can click that smite button til you are blue in the face. It won't change the fact that if you set unbound up correctly it works fine and if you don't it doesn't.
There are alot of settings that affect unbound. Setting up dnsmasq is easier. I'll say that much.
I also had problems with unbound when I first started playing with it but after changing a few of the advanced setting and fixing my stupid settings I had entered into general setup, all problems disappeared.
Maybe it only works for dense people?
BTW - Why is it offensive to you that I think that more than likely bad setting cause most of the problems with unbound?
My definition of a problem is "DNS doesn't work". Not - "Ohhhhh I see that DNS restarts sometimes".
If my computers were not resolving websites and the web was acting flakey for me I'd be right along with the rest complaining.
However, fact is, its working fine. Since I have no special magic happening here, I have to believe this is a setting problem.
-
You can click that smite button til you are blue in the face. It won't change the fact that if you set unbound up correctly it works fine and if you don't it doesn't.
There are alot of settings that affect unbound. Setting up dnsmasq is easier. I'll say that much.
I also had problems with unbound when I first started playing with it but after changing a few of the advanced setting and fixing my stupid settings I had entered into general setup, all problems disappeared.
Maybe it only works for dense people?
Maybe. My secondary pfSense install has problems too once a few wireless clients connect -> restart and intermittent resolve errors.
Funny thing, considering this is a stock forwarding setup according to docs - no advanced settings, no nothing.
No wonder so many people are seeing this, clearly there are bugs…
-
BTW - I see alot of people doing alot of really silly things with pfsense and the one thing all those people have in common it they all think their way should be fine and its got to be that pfsense is brrrrrroooooooked.
Anyway - Hope you figure it out.
-
BTW - I see alot of people doing alot of really silly things with pfsense and the one thing all those people have in common it they all think their way should be fine and its got to be that pfsense is brrrrrroooooooked.
Anyway - Hope you figure it out.
I did. Solution is not to use unbound.
-
Well - For forwarding, I agree with you there. Even if unbound worked flawlessly for you, I'd recommend dnsmasq for forwarding and unbound for recursive resolver.
-
Compare time of these:
In the DHCP log :
Apr 22 23:20:41 dhcpd: Wrote 250 leases to leases file.
Apr 22 23:20:41 dhcpd: Wrote 0 new dynamic host decls to leases file.
Apr 22 23:20:41 dhcpd: Wrote 0 deleted host decls to leases file.with these (in the Resolver log):
Apr 22 23:20:41 unbound: [68253:0] info: start of service (unbound 1.5.3).
Apr 22 23:20:41 unbound: [68253:0] info: service stopped (unbound 1.5.3).I tend to say: when leases are written, unbound is restarted.
Or: every time a new lease (unkown before) pops in, unbound is restarted.
If you have many (many !) device on your LAN (or a very short DHCP lease time like the default 7200 sec) then ….. well .... you'll see what you see.Read also https://forum.pfsense.org/index.php?topic=88240.msg514643#msg514643
-
Could be - But is that broken or is that normal function?
(I'm definitely not seeing lots of restarts BTW)
-
Compare time of these:
In the DHCP log :
Apr 22 23:20:41 dhcpd: Wrote 250 leases to leases file.
Apr 22 23:20:41 dhcpd: Wrote 0 new dynamic host decls to leases file.
Apr 22 23:20:41 dhcpd: Wrote 0 deleted host decls to leases file.with these (in the Resolver log):
Apr 22 23:20:41 unbound: [68253:0] info: start of service (unbound 1.5.3).
Apr 22 23:20:41 unbound: [68253:0] info: service stopped (unbound 1.5.3).I tend to say: when leases are written, unbound is restarted.
Or: every time a new lease (unkown before) pops in, unbound is restarted.
If you have many (many !) device on your LAN (or a very short DHCP lease time like the default 7200 sec) then ….. well .... you'll see what you see.Read also https://forum.pfsense.org/index.php?topic=88240.msg514643#msg514643
But even though it restarts, it doesn't lose any "resolving" capability, right?
-
Here is a clip from my logs:
Apr 15 20:02:42 unbound: [53580:0] info: start of service (unbound 1.5.3).
Apr 15 20:02:42 unbound: [53580:0] notice: init module 1: iterator
Apr 15 20:02:42 unbound: [53580:0] notice: init module 0: validator
Apr 15 20:02:42 unbound: [53580:0] notice: Restart of unbound 1.5.3.
Apr 15 20:02:42 unbound: [53580:0] info: server stats for thread 1: requestlist max 6 avg 3.88889 exceeded 0 jostled 0
Apr 15 20:02:42 unbound: [53580:0] info: server stats for thread 1: 9 queries, 0 answers from cache, 9 recursions, 0 prefetch
Apr 15 20:02:42 unbound: [53580:0] info: server stats for thread 0: requestlist max 21 avg 11.6667 exceeded 0 jostled 0
Apr 15 20:02:42 unbound: [53580:0] info: server stats for thread 0: 39 queries, 0 answers from cache, 39 recursions, 0 prefetch
Apr 15 20:02:42 unbound: [53580:0] info: service stopped (unbound 1.5.3).
Apr 15 20:02:42 unbound: [53580:0] info: start of service (unbound 1.5.3).
Apr 15 20:02:42 unbound: [53580:0] notice: init module 1: iterator
Apr 15 20:02:42 unbound: [53580:0] notice: init module 0: validator
Apr 15 20:02:42 unbound: [53580:0] notice: Restart of unbound 1.5.3.
Apr 15 20:02:42 unbound: [53580:0] info: server stats for thread 1: requestlist max 2 avg 1.33333 exceeded 0 jostled 0
Apr 15 20:02:42 unbound: [53580:0] info: server stats for thread 1: 3 queries, 0 answers from cache, 3 recursions, 0 prefetch
Apr 15 20:02:42 unbound: [53580:0] info: server stats for thread 0: requestlist max 0 avg 0 exceeded 0 jostled 0
Apr 15 20:02:42 unbound: [53580:0] info: server stats for thread 0: 1 queries, 0 answers from cache, 1 recursions, 0 prefetch
Apr 15 20:02:42 unbound: [53580:0] info: service stopped (unbound 1.5.3).
Apr 15 20:02:42 unbound: [53580:0] info: start of service (unbound 1.5.3).
Apr 15 20:02:42 unbound: [53580:0] notice: init module 1: iterator
Apr 15 20:02:42 unbound: [53580:0] notice: init module 0: validator
Apr 15 20:02:42 unbound: [53580:0] notice: Restart of unbound 1.5.3.
Apr 15 20:02:42 unbound: [53580:0] info: server stats for thread 1: requestlist max 0 avg 0 exceeded 0 jostled 0
Apr 15 20:02:42 unbound: [53580:0] info: server stats for thread 1: 0 queries, 0 answers from cache, 0 recursions, 0 prefetch
Apr 15 20:02:42 unbound: [53580:0] info: server stats for thread 0: requestlist max 0 avg 0 exceeded 0 jostled 0
Apr 15 20:02:42 unbound: [53580:0] info: server stats for thread 0: 0 queries, 0 answers from cache, 0 recursions, 0 prefetch
Apr 15 20:02:42 unbound: [53580:0] info: service stopped (unbound 1.5.3).
Apr 15 20:02:42 unbound: [53580:0] info: start of service (unbound 1.5.3).
Apr 15 20:02:42 unbound: [53580:0] notice: init module 1: iterator
Apr 15 20:02:42 unbound: [53580:0] notice: init module 0: validator
Mar 29 23:23:26 unbound: [88947:0] info: start of service (unbound 1.5.3).
Mar 29 23:23:26 unbound: [88947:0] notice: init module 1: iterator
Mar 29 23:23:26 unbound: [88947:0] notice: init module 0: validator
Mar 29 23:23:26 unbound: [88947:0] notice: Restart of unbound 1.5.3.
Mar 29 23:23:26 unbound: [88947:0] info: 2.000000 4.000000 1
Mar 29 23:23:26 unbound: [88947:0] info: 1.000000 2.000000 1
Mar 29 23:23:26 unbound: [88947:0] info: 0.524288 1.000000 8
Mar 29 23:23:26 unbound: [88947:0] info: 0.262144 0.524288 50
Mar 29 23:23:26 unbound: [88947:0] info: 0.131072 0.262144 91So, to me, it looks like its only really restarting when its supposed to to deal with attacks against it, badly formed DNS entries etc etc.
It went 15 days without a restart from Mar 29 - April 15 and whats today? 23rd? so its been 8 days since last restart of unbound?Doesn't seem too broken to me….
However, I really do think setting matter. Alot.
-
I'm guessing you have "Register DHCP leases in the DNS Resolver" disabled, or you don't have DHCP leases with dynamic address.
I've just turned this off in my configuration, and waiting/watching to see if it resolves my issues.
-
Nope - I have those things enabled. Both of them.
But I don't have IP conflicts and nor am I connected to one machine with both wire and wireless.
And the general settings matter and so does the advanced setting in unbound.
Without looking at people's pfsense with my own eyes and going through all the setting its hard to know what is causing some people problems.
-
Nope - I have those things enabled. Both of them.
Hmm… only one of these things is a setting (in the General tab) that can be enabled. The other is a dynamic artifact of the environment and DHCP mapping.
But I don't have IP conflicts and nor am I connected to one machine with both wire and wireless.
I also do not have this.
And the general settings matter and so does the advanced setting in unbound.
Just for clarity, can you explain what you are referring to in the settings? In particular, is there anything other than "Enable DNSSEC Support" and "Register DHCP leases in the DNS Resolver" (mentioned above) that you are referring to?
Thanks
-
I can tell you my settings…
Enabled:
DNSSEC
DHCP Registration
Static DHCP
In advanced Settings besides what came enabled, I also Enabled:
Hide Identity
Hide Version
Prefetch Support
Prefetch DNS Key Support
Harden DNSSEC data
Unwanted Reply Threshold 10 millionI have no DNS IPs in the general settings of pfsense. None.
-
But even though it restarts, it doesn't lose any "resolving" capability, right?
Depends. Often it takes about 30 seconds after a restart before it starts resolving, long enough to be annoying since it happens all the time on some routers.
