Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Unbound seems to be restarting frequently

    Scheduled Pinned Locked Moved
    DHCP and DNS
    43
    178
    61.1k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • K
      ky41083 Banned
      last edited by

      @doktornotor:

      Perhaps, can you send me further personal shit, hire offers and shrink doctor recommendations via PM? It will get safely ignored there; plus it won't produce useless noise for other forum users here that noone's interested in reading.

      Alternatively, just STFU and start coding.

      Because God forbid anyone else actually realize what a fucktard you are, right?

      Ohhh, did you bump your head? Take your own advice there kiddo.

      If you want to be a "I don't understand this so I'm going to troll and shit all over it" dick, on a non-technical and personal level, publicly. Then I will continue to hand you your ass, publicly. Perhaps your masturbation comment (really all of your comments) are more appropriate as a PM, since they do indeed fit your "useless noise for other forum users here that noone's interested in reading" category.

      And again with the control issues. Seriously, get help. Your attitude is one only a mother on heroine could love.

      1 Reply Last reply Reply Quote 0
      • D
        doktornotor Banned
        last edited by

        Lick my swamp.

        1 Reply Last reply Reply Quote 0
        • K
          ky41083 Banned
          last edited by

          Snappy comeback.

          1 Reply Last reply Reply Quote 0
          • K
            ky41083 Banned
            last edited by

            Bug opened: https://redmine.pfsense.org/issues/5413

            1 Reply Last reply Reply Quote 0
            • J
              JohnPFsense
              last edited by

              This solved it for me:

              https://forum.pfsense.org/index.php?topic=102470.msg578573#msg578573

              • John -
              1 Reply Last reply Reply Quote 0
              • 5
                55c40e301e
                last edited by

                @ky41083:

                How many people having this issue are using a config that used to use the forwarder rather than the resolver? And how many of those people still have the top 3 DHCP options checked in the forwarder, even though the forwarder is disabled?

                If this is the case, humor me here… go to the DNS forwarder page, check the top enable box to enable access to the 3 DHCP options boxes below it, uncheck all 3 DHCP options boxes, then uncheck the top enable box (so we don't unwantingly enable the forwarder), click the save button, verify that all 3 DHCP options boxes for the forwarder are now unchecked and disabled once the page reloads, and reboot pfSense for sanity.

                Please post back as to what effect this has on Unbound reloads… either the same, less frequently, or eliminates them all together.

                For me this stopped the repeated "unbound: service stopped", "unbound: start of service" messages 2-3 times per minute. Thanks - this was a longstanding issue.

                It fit because this installation was previously dnsmasq, switched to unbound some time ago.

                Specifically, the relevant part of the config export looked like this before:

                	 <dnsmasq><regdhcpstatic><custom_options><domain_needed><no_private_reverse><interface></interface></no_private_reverse></domain_needed></custom_options></regdhcpstatic></dnsmasq>

                and like this after:

                	 <dnsmasq><custom_options><domain_needed><no_private_reverse><interface></interface></no_private_reverse></domain_needed></custom_options></dnsmasq>

                It also took a reboot.

                A more subtle issue for me is that machines seem to lose DNS resolution (maybe all connectivity?) for about 5 seconds every time their DHCP lease expires and is renewed. For now I've just lengthened DHCP leases significantly - they were short for testing. Separate issue I guess.

                1 Reply Last reply Reply Quote 0
                • R
                  robi
                  last edited by

                  I had to go back to DNS Forwarder (dnsmasq) because of this. Thank God it's still inthere and only a checkbox away.

                  1 Reply Last reply Reply Quote 0
                  • K
                    ky41083 Banned
                    last edited by

                    @David_W:

                    I know a bug report is not really the place for arguing about the merits of a solution, but I respectfully maintain some of my caution in https://forum.pfsense.org/index.php?topic=89589.msg568394#msg568394 , especially in relation to ky41083's assertion that there is no need ever to restart Unbound.

                    Changes in local-data can be handled via unbound-control as ky41083 says - though the inability to remove just the A or AAAA record will likely require some care, as both can exist for the same local host and there is no guaranteed temporal relationship between changes in A and AAAA. In particular, DHCP and DHCPv6 are entirely separate and not synchronous.

                    Unlike ky41083, I cannot see any alternative to restarting Unbound if there are configuration changes made to Unbound beyond changes to local data, as SIGHUP and unbound-control reload unfortunately amount to a reload at present (i.e. cache flush and re-read of the configuration files). unbound-control does not allow for on-the-fly reconfiguration of all aspects of Unbound. This is why I suggested a diff based approach on the forums as one possibility.

                    These are, of course, implementation points. I agree that Unbound should be reconfigured on-the-fly whenever possible. In time, I hope that Unbound will get saner SIGHUP handling, but this will likely be a lot of work.

                    Unfortunately, I have no time to work on this issue at present.

                    You are under thinking the problem and over thinking the solution.

                    Quickly now…

                    DHCPv4 & DHCPv6 are entirely separate and not synchronous, agreed. DNS records are only removed when a lease expires, right? How many milliseconds do you think will differ between v4 and v6 leases being obtained by the same host? So deleting just the A or just the AAAA record, vs removing them both at the same time, matters how much, in the real world? Milliseconds, that you can no longer resolve an internal host via DNS, which has been off for (DHCP lease period) anyhow.

                    If this causes issues for you, make your DHCPv4 & DHCPv6 lease expiration times identical, or fix your DHCP clients that aren't requesting v4 and v6 leases at the same time for who knows why.

                    If this is causing internal host overrides to be removed, you're putting persistent local host DNS records in the wrong place. DNS is where you put external DNS redirects. DHCP reservations is where you put persistent local host DNS records so they never get removed.

                    Please, I would love a correct list of things that cannot be changed without restarting Unbound, from someone that's not me.

                    1 Reply Last reply Reply Quote 0
                    • W
                      W4RH34D
                      last edited by

                      @JohnPFsense:

                      This solved it for me:

                      https://forum.pfsense.org/index.php?topic=102470.msg578573#msg578573

                      • John -

                      Ring a ding ding same here.
                      Though I had track disabled, I had to just completely disable IPv6 in sys/adv/networking.

                      Did you really check your cables?

                      1 Reply Last reply Reply Quote 0
                      • P
                        pfcode
                        last edited by

                        @W4RH34D:

                        @JohnPFsense:

                        This solved it for me:

                        https://forum.pfsense.org/index.php?topic=102470.msg578573#msg578573

                        • John -

                        Ring a ding ding same here.
                        Though I had track disabled, I had to just completely disable IPv6 in sys/adv/networking.

                        There is an issue in Unbound, I will have to disable DNSBL so that there is no "server:include: /var/unbound/pfb_dnsbl.conf" in Unbound custom options window.

                        see my posts: https://forum.pfsense.org/index.php?topic=113193.0  and https://forum.pfsense.org/index.php?topic=114277.0

                        so far no response from pfSense Dev teams.

                        Release: pfSense 2.4.3(amd64)
                        M/B: Supermicro A1SRi-2558F
                        HDD: Intel X25-M 160G
                        RAM: 2x8Gb Kingston ECC ValueRAM
                        AP: Netgear R7000 (XWRT), Unifi AC Pro

                        1 Reply Last reply Reply Quote 0
                        • C
                          chrcoluk
                          last edited by

                          I also have found unbound is restarted whenever wan ipv6 is renewed on dhcp6.

                          so First this occurs

                          /rc.newwanipv6: rc.newwanipv6:

                          then gateway etc. been set
                          After this occurs

                          check_reload_status		Reloading filter

                          At same time in resolver log unbound is restarted.

                          Now with only small dnsbl lists loaded in pfblockerng this is not a major issue as I have found even uncached queries on my pfsense box are faster than when I used the asus ac68 as my router, however each unbound restart does also have to process the dnsbl lists which is a slow process if I have large lists loaded.

                          I will look at the pfsense code and see if I can submit a fix that will be accepted, its probably easy to hack this like someone did earlier in the thread but ideally a clean solution would be found that can be accepted as a improvement, since there is no need to restart unbound just for renewing the same ipv6 prefix.

                          using"SECOIT GmbH" code, is ok but I think will stop unbound been reloaded when dnsbl gets updated daily on my box, so instead I commented out a line in rc.newwanipv6 which forces a unbound restart.  Later after sleep I will look into only skipping the unbound restart in rc.newwanipv6 when its not on bootup and when the actual ipv6 on the pfsense box has not changed, so in other words add a check to see if the new ipv6 matches the previous, if it does skip the reload.

                          pfSense CE 2.7.2

                          1 Reply Last reply Reply Quote 0
                          • N
                            nextloop
                            last edited by

                            I have WAN and LAN IPv6 both static and I am also affected by it.

                            1 Reply Last reply Reply Quote 0
                            • K
                              ky41083 Banned
                              last edited by

                              For 2.3.x users without DNSBL active, this fixes everything. Someone could easily make a diff patch for DNSBL based on it as well:
                              https://forum.pfsense.org/index.php?topic=119467.msg661037#msg661037

                              1 Reply Last reply Reply Quote 0
                              • P
                                pfadmin
                                last edited by

                                hi, same problem. IPv6 every 15 minutes starts unbound and with dnsbl it tooks a long time..

                                ky41083, your link doesn't work, same here https://redmine.pfsense.org/issues/5413

                                Any solution? cache or not is not realy the problem, no answer is what I get.

                                pfadmin

                                1 Reply Last reply Reply Quote 0
                                • S
                                  scurrier
                                  last edited by

                                  +1 I am affected by this as well.  Whenever the DHCP logs show "Sending HUP signal to dns daemon(17620)" the DNS logs show that unbound has reset.

                                  1 Reply Last reply Reply Quote 0
                                  • S
                                    StyleNZ
                                    last edited by

                                    @scurrier:

                                    +1 I am affected by this as well.  Whenever the DHCP logs show "Sending HUP signal to dns daemon(17620)" the DNS logs show that unbound has reset.

                                    +1. Same problem for me too. I was using using DHCP on my Windows Server originally without problem but have now since switched to using pfSense for DHCP as the layout and customization is better suited to my liking. Since changing, I have noticed Unbound stopping from DHCP interfering with it like you say and others here have said. I took some screen shots of the logs too if it could be of assistance.

                                    I also use pfBlockerNG with DNSBL also.

                                    Cheers.

                                    [Edit: Unchecking Register DHCP leases in the DNS Resolver appears to have resolved it for me. Leaving the static mappings checked seems to be fine so far though, I'll report back later otherwise.]

                                    1 Reply Last reply Reply Quote 0
                                    • D
                                      dersch
                                      last edited by

                                      +1 i have the same issue now since a couple of days without changing anything! Running on 2.4.2-DEVELOPMENT because i need the PPPOE Vlan Tag functionality which is not working with the latest stable.

                                      
Nov 15 14:32:17	unbound	58529:0	info: start of service (unbound 1.6.6).
Nov 15 14:32:17	unbound	58529:0	notice: init module 1: iterator
Nov 15 14:32:17	unbound	58529:0	notice: init module 0: validator
Nov 15 14:32:17	unbound	58529:0	notice: Restart of unbound 1.6.6.
Nov 15 14:32:17	unbound	58529:0	info: server stats for thread 1: requestlist max 0 avg 0 exceeded 0 jostled 0
Nov 15 14:32:17	unbound	58529:0	info: server stats for thread 1: 0 queries, 0 answers from cache, 0 recursions, 0 prefetch, 0 rejected by ip ratelimiting
Nov 15 14:32:17	unbound	58529:0	info: server stats for thread 0: requestlist max 0 avg 0 exceeded 0 jostled 0
Nov 15 14:32:17	unbound	58529:0	info: server stats for thread 0: 0 queries, 0 answers from cache, 0 recursions, 0 prefetch, 0 rejected by ip ratelimiting
Nov 15 14:32:17	unbound	58529:0	info: service stopped (unbound 1.6.6).
Nov 15 14:32:17	unbound	58529:0	info: start of service (unbound 1.6.6).
Nov 15 14:32:17	unbound	58529:0	notice: init module 1: iterator
Nov 15 14:32:17	unbound	58529:0	notice: init module 0: validator
Nov 15 14:32:14	unbound	15323:0	info: 0.065536 0.131072 3
Nov 15 14:32:14	unbound	15323:0	info: 0.016384 0.032768 1
Nov 15 14:32:14	unbound	15323:0	info: lower(secs) upper(secs) recursions
Nov 15 14:32:14	unbound	15323:0	info: [25%]=0.032768 median[50%]=0.0873813 [75%]=0.109227
Nov 15 14:32:14	unbound	15323:0	info: histogram of recursion processing times
Nov 15 14:32:14	unbound	15323:0	info: average recursion processing time 0.067271 sec
Nov 15 14:32:14	unbound	15323:0	info: server stats for thread 1: requestlist max 1 avg 0.25 exceeded 0 jostled 0
Nov 15 14:32:14	unbound	15323:0	info: server stats for thread 1: 4 queries, 0 answers from cache, 4 recursions, 0 prefetch, 0 rejected by ip ratelimiting
Nov 15 14:32:14	unbound	15323:0	info: 0.065536 0.131072 1
Nov 15 14:32:14	unbound	15323:0	info: lower(secs) upper(secs) recursions
Nov 15 14:32:14	unbound	15323:0	info: [25%]=0 median[50%]=0 [75%]=0
Nov 15 14:32:14	unbound	15323:0	info: histogram of recursion processing times
Nov 15 14:32:14	unbound	15323:0	info: average recursion processing time 0.081054 sec
Nov 15 14:32:14	unbound	15323:0	info: server stats for thread 0: requestlist max 0 avg 0 exceeded 0 jostled 0
Nov 15 14:32:14	unbound	15323:0	info: server stats for thread 0: 1 queries, 0 answers from cache, 1 recursions, 0 prefetch, 0 rejected by ip ratelimiting
Nov 15 14:32:14	unbound	15323:0	info: service stopped (unbound 1.6.6).
Nov 15 14:32:11	unbound	15323:0	info: start of service (unbound 1.6.6).
Nov 15 14:32:11	unbound	15323:0	notice: init module 1: iterator
Nov 15 14:32:11	unbound	15323:0	notice: init module 0: validator
Nov 15 14:32:11	unbound	15323:0	notice: Restart of unbound 1.6.6.
Nov 15 14:32:11	unbound	15323:0	info: server stats for thread 1: requestlist max 0 avg 0 exceeded 0 jostled 0
Nov 15 14:32:11	unbound	15323:0	info: server stats for thread 1: 0 queries, 0 answers from cache, 0 recursions, 0 prefetch, 0 rejected by ip ratelimiting
Nov 15 14:32:11	unbound	15323:0	info: server stats for thread 0: requestlist max 0 avg 0 exceeded 0 jostled 0
Nov 15 14:32:11	unbound	15323:0	info: server stats for thread 0: 0 queries, 0 answers from cache, 0 recursions, 0 prefetch, 0 rejected by ip ratelimiting
Nov 15 14:32:11	unbound	15323:0	info: service stopped (unbound 1.6.6).
Nov 15 14:32:11	unbound	15323:0	info: start of service (unbound 1.6.6).
Nov 15 14:32:11	unbound	15323:0	notice: init module 1: iterator
Nov 15 14:32:11	unbound	15323:0	notice: init module 0: validator
Nov 15 14:32:08	unbound	83784:0	info: 0.131072 0.262144 1
Nov 15 14:32:08	unbound	83784:0	info: 0.065536 0.131072 1
Nov 15 14:32:08	unbound	83784:0	info: 0.016384 0.032768 2
Nov 15 14:32:08	unbound	83784:0	info: 0.001024 0.002048 1
Nov 15 14:32:08	unbound	83784:0	info: lower(secs) upper(secs) recursions
Nov 15 14:32:08	unbound	83784:0	info: [25%]=0.018432 median[50%]=0.028672 [75%]=0.114688
Nov 15 14:32:08	unbound	83784:0	info: histogram of recursion processing times
Nov 15 14:32:08	unbound	83784:0	info: average recursion processing time 0.062189 sec
Nov 15 14:32:08	unbound	83784:0	info: server stats for thread 1: requestlist max 2 avg 0.666667 exceeded 0 jostled 0
Nov 15 14:32:08	unbound	83784:0	info: server stats for thread 1: 6 queries, 0 answers from cache, 6 recursions, 0 prefetch, 0 rejected by ip ratelimiting
Nov 15 14:32:08	unbound	83784:0	info: 1.000000 2.000000 1
Nov 15 14:32:08	unbound	83784:0	info: 0.524288 1.000000 1
Nov 15 14:32:08	unbound	83784:0	info: 0.131072 0.262144 1
Nov 15 14:32:08	unbound	83784:0	info: 0.008192 0.016384 1
Nov 15 14:32:08	unbound	83784:0	info: lower(secs) upper(secs) recursions
Nov 15 14:32:08	unbound	83784:0	info: [25%]=0.016384 median[50%]=0.262144 [75%]=1
Nov 15 14:32:08	unbound	83784:0	info: histogram of recursion processing times
Nov 15 14:32:08	unbound	83784:0	info: average recursion processing time 0.753388 sec
Nov 15 14:32:08	unbound	83784:0	info: server stats for thread 0: requestlist max 3 avg 1.25 exceeded 0 jostled 0
Nov 15 14:32:08	unbound	83784:0	info: server stats for thread 0: 5 queries, 1 answers from cache, 4 recursions, 0 prefetch, 0 rejected by ip ratelimiting
Nov 15 14:32:08	unbound	83784:0	info: service stopped (unbound 1.6.6).
Nov 15 14:32:05	unbound	83784:0	info: start of service (unbound 1.6.6).
Nov 15 14:32:05	unbound	83784:0	notice: init module 1: iterator
Nov 15 14:32:05	unbound	83784:0	notice: init module 0: validator
Nov 15 14:32:05	unbound	83784:0	notice: Restart of unbound 1.6.6.
Nov 15 14:32:05	unbound	83784:0	info: server stats for thread 1: requestlist max 0 avg 0 exceeded 0 jostled 0
Nov 15 14:32:05	unbound	83784:0	info: server stats for thread 1: 0 queries, 0 answers from cache, 0 recursions, 0 prefetch, 0 rejected by ip ratelimiting
Nov 15 14:32:05	unbound	83784:0	info: server stats for thread 0: requestlist max 0 avg 0 exceeded 0 jostled 0
Nov 15 14:32:05	unbound	83784:0	info: server stats for thread 0: 0 queries, 0 answers from cache, 0 recursions, 0 prefetch, 0 rejected by ip ratelimiting
Nov 15 14:32:05	unbound	83784:0	info: service stopped (unbound 1.6.6).
Nov 15 14:32:05	unbound	83784:0	info: start of service (unbound 1.6.6).
Nov 15 14:32:05	unbound	83784:0	notice: init module 1: iterator
Nov 15 14:32:05	unbound	83784:0	notice: init module 0: validator
Nov 15 14:32:02	unbound	39724:0	info: 0.008192 0.016384 1
Nov 15 14:32:02	unbound	39724:0	info: lower(secs) upper(secs) recursions
Nov 15 14:32:02	unbound	39724:0	info: [25%]=0 median[50%]=0 [75%]=0
Nov 15 14:32:02	unbound	39724:0	info: histogram of recursion processing times
Nov 15 14:32:02	unbound	39724:0	info: average recursion processing time 0.011720 sec
Nov 15 14:32:02	unbound	39724:0	info: server stats for thread 1: requestlist max 0 avg 0 exceeded 0 jostled 0
Nov 15 14:32:02	unbound	39724:0	info: server stats for thread 1: 4 queries, 2 answers from cache, 2 recursions, 0 prefetch, 0 rejected by ip ratelimiting
Nov 15 14:32:02	unbound	39724:0	info: 0.131072 0.262144 1
Nov 15 14:32:02	unbound	39724:0	info: lower(secs) upper(secs) recursions
Nov 15 14:32:02	unbound	39724:0	info: [25%]=0 median[50%]=0 [75%]=0
Nov 15 14:32:02	unbound	39724:0	info: histogram of recursion processing times
Nov 15 14:32:02	unbound	39724:0	info: average recursion processing time 0.152199 sec
Nov 15 14:32:02	unbound	39724:0	info: server stats for thread 0: requestlist max 0 avg 0 exceeded 0 jostled 0
Nov 15 14:32:02	unbound	39724:0	info: server stats for thread 0: 2 queries, 0 answers from cache, 2 recursions, 0 prefetch, 0 rejected by ip ratelimiting
Nov 15 14:32:02	unbound	39724:0	info: service stopped (unbound 1.6.6).
Nov 15 14:31:59	unbound	39724:0	info: failed to prime trust anchor -- DNSKEY rrset is not secure . DNSKEY IN
Nov 15 14:31:59	unbound	39724:0	info: start of service (unbound 1.6.6).
Nov 15 14:31:59	unbound	39724:0	notice: init module 1: iterator
Nov 15 14:31:59	unbound	39724:0	notice: init module 0: validator
Nov 15 14:31:59	unbound	39724:0	notice: Restart of unbound 1.6.6.
Nov 15 14:31:59	unbound	39724:0	info: server stats for thread 1: requestlist max 0 avg 0 exceeded 0 jostled 0
Nov 15 14:31:59	unbound	39724:0	info: server stats for thread 1: 0 queries, 0 answers from cache, 0 recursions, 0 prefetch, 0 rejected by ip ratelimiting
Nov 15 14:31:59	unbound	39724:0	info: server stats for thread 0: requestlist max 0 avg 0 exceeded 0 jostled 0
Nov 15 14:31:59	unbound	39724:0	info: server stats for thread 0: 0 queries, 0 answers from cache, 0 recursions, 0 prefetch, 0 rejected by ip ratelimiting
Nov 15 14:31:59	unbound	39724:0	info: service stopped (unbound 1.6.6).
Nov 15 14:31:59	unbound	39724:0	info: start of service (unbound 1.6.6).
Nov 15 14:31:59	unbound	39724:0	notice: init module 1: iterator
                                      1 Reply Last reply Reply Quote 0
                                      • R
                                        renegade
                                        last edited by

                                        Similar issue on 2.4.1. already posted in pfblocker forum as i thought the error occurres from that side.

                                        Nov 14 23:03:28 	unbound 	45240:0 	info: start of service (unbound 1.6.6).
Nov 14 23:02:57 	unbound 	45240:0 	info: service stopped (unbound 1.6.6).
Nov 14 23:02:57 	unbound 	45240:0 	info: start of service (unbound 1.6.6).
Nov 14 23:02:25 	unbound 	45240:0 	info: service stopped (unbound 1.6.6).
Nov 14 23:00:08 	filterdns 		adding entry 2a02:26f0:6a:280::3d5 to pf table certbot for host acme-v01.api.letsencrypt.org
Nov 14 23:00:08 	filterdns 		adding entry 2a02:26f0:6a:293::3d5 to pf table certbot for host acme-v01.api.letsencrypt.org
Nov 14 23:00:08 	filterdns 		adding entry 104.74.107.171 to pf table certbot for host acme-v01.api.letsencrypt.org
                                        1 Reply Last reply Reply Quote 0
                                        • R
                                          renegade
                                          last edited by

                                          are there any further investigations?
                                          do you need more information/ logs?

                                          1 Reply Last reply Reply Quote 0
                                          • R
                                            Rai80
                                            last edited by

                                            @renegade:

                                            Similar issue on 2.4.1. already posted in pfblocker forum as i thought the error occurres from that side.

                                            Nov 14 23:03:28 	unbound 	45240:0 	info: start of service (unbound 1.6.6).
Nov 14 23:02:57 	unbound 	45240:0 	info: service stopped (unbound 1.6.6).
Nov 14 23:02:57 	unbound 	45240:0 	info: start of service (unbound 1.6.6).
Nov 14 23:02:25 	unbound 	45240:0 	info: service stopped (unbound 1.6.6).
Nov 14 23:00:08 	filterdns 		adding entry 2a02:26f0:6a:280::3d5 to pf table certbot for host acme-v01.api.letsencrypt.org
Nov 14 23:00:08 	filterdns 		adding entry 2a02:26f0:6a:293::3d5 to pf table certbot for host acme-v01.api.letsencrypt.org
Nov 14 23:00:08 	filterdns 		adding entry 104.74.107.171 to pf table certbot for host acme-v01.api.letsencrypt.org

                                            Exact same issue here. Im on version 2.4.2.

                                            It is solved when disabling DHCP registrations in DNS.

                                            T 1 Reply Last reply Reply Quote 1
                                            • First post
                                              Last post