DNS Resolver Status, no data?

KOM

Same here. I had never noticed that before.

Rico

I see some data here

-Rico

provels

This morning I had some data, so I added a couple more servers. Had data for them, too. One of the last things I had done was to remove the Resolver from Service Watchdog while I was messing with DNS Resolver resolving/forwarding and dnsmasq. Stats remained but were lost on a reboot. Stats have not populated since even after various nslookups and web use. Baffled.

NogBadTheBad

Data here.

0_1552477536024_Screenshot 2019-03-13 at 11.44.23.png

johnpoz

If your not seeing status there, then its not asking anything.. You sure your actually using the resolver - and don't have your clients asking someone else? Did you point pfsense to something other than 127.0.0.1?

provels

The only client is li'l old me. Most devices are static IPs (outside DHCP range, but registered in DNS), but a few are DHCP. Statics use FW for DNS. Resolver is enabled in forwarding mode right now, DNS servers are Quad9 and Cloudflare (in General Setup) plus localhost. I earlier saw data on them, since cleared. Assuming this data does not save to disk on reboot? Still no data, been surfing for several hours.

provels

OK, I have data now. Why? No idea. Is there some job that has to run?
Still in forwarder mode, removed, Quad9 servers, data page updated to reflect.
Changed to resolver mode, immediately had 50-60 lines each in Cache Speed and Cache Stats. Baffled x2. Going to reboot now, assuming this data is volatile?

provels

OK, so data is there after reboot (and then some...). Still Resolver mode.
Around 475 lines in each section (Speed and Stats). Both IPv4, IPv6 addresses... Running only IPv4 here. Sorry if I'm being dense.0_1552502264304_Speed-Stats.txt

johnpoz

My take on this is you don't actually understand what those stats are.. Or how a resolver works..

If you flip into forwarder mode it will show you that or multiple if it ever asks multiple stats.. But really means nothing in forwarder mode at all.. Those stats are what resolver uses to determine which NS it should ask for a given domain, etc. be it root or domain.xyz..

If all you do is forward to A, what would be the point.. If you could forward to A or B then guess could use those stats which to ask A or B..

There is little need for you to even look into what those stats are unless you were troubleshooting specific sort of issue.

KOM

I run Resolver. No forwarding. Mine is full of stats now. It wasn't yesterday. Uptime is 48 days.

So what changed? Why no stats yesterday, and a full page today?

johnpoz

I have no idea.. You have provided ZERO info on your setup..

Here resolver mode.., changed to forward mode google, stats

Its not freaking rocket science here people

Your typical user is going to have ZERO understanding of what those stats even mean to be honest ;) Anyone that would actually want/need them would be able to pull them from the cmd line anyway..

Now back to resolver mode because forwarding = uuuuggghhhh!

provels

That's entirely possible. But I'm in Resolver mode now. All I ever saw in Forwarder mode was data for the servers setup in General, which figures. Why should it ask anybody else? A Resolver goes straight to the roots. But until recently I saw no data at all in either mode. Doesn't resolver use that cache data to know which root server will give it the fastest reply? Without the cache, what happens? Dud DNS?

johnpoz

It uses the roots to do the first lookups.. Picks 1 at random... They all that the same info... Your just asking 1 of the root servers for the NS of com, or net or edu or whatever you asking.

It then keeps a cache at how fast these different NS it talks to respond.. If it finds out that hey root A answers faster than C... Its going to first try A, before it asks C for anything, etc. etc.

Your typical user has zero use for this info.. Al he wants to know is hey I ask for www.google.com and got back an IP..

You would really only need to look at this info when troubleshooting the most odd sorts of issues.. Other than just curiosity sake - or overall health to see if your seeing any sort of timeouts and what sort of response times your getting, etc.

There back to showing stats for normal resolver stuff the second after changing back

And to be honest would prob not ever look at it in this sort of output.. Its too much info... Your prob going to ask for the infra cache info for the specific domain you are having issues resolving from, etc..

Why they even put this on a menu item - is nothing more than eye candy if you ask me.

KOM

And now my list is back to No Data...

I don't think details of my setup have anything to do with a stats page being filled by a service that is running.

And now I have some limited data there. All this in the span of 5 minutes. This makes no sense unless this page has a short time threshold before it wipes everything.

johnpoz

You have something wrong if your not seeing data and actually using the resolver... After it does one query.. It will store that info.

Is your resolving actual working? what does your resolver log show?

For all we know your resolver is running but your not actually asking it anything.

Maybe you got a browser cache issue that is not showing the info should be showing - do the query from the cmd line of pfsense. One sec and give an example.

Grimson

@kom said in DNS Resolver Status, no data?:

And now I have some limited data there. All this in the span of 5 minutes. This makes no sense unless this page has a short time threshold before it wipes everything.

How often is unbound restarting on your system? Check the logs.

johnpoz

Here is from cmd line

$0_1552504214462_infracachedump.png$

All the web gui does it take the output of that and present it..

No unbound is not going to wipe that data on any sort of schedule.. This the data it uses to know which NS are best to talk to, etc.

Take a look to see how many actual queries have happened since unbound restarted

total.num.queries=287
total.num.queries_ip_ratelimited=0
total.num.cachehits=218
total.num.cachemiss=69

Use
unbound-control -c /var/unbound/unbound.conf stats_noreset

Look through for total, etc. How many queries happened, etc. since unbound restarted. If 0 then no nothing going to be in the stats for the infa.

KOM

You have something wrong if your not seeing data and actually using the resolver... After it does one query.. It will store that info.

I think pfSense might be doing something wrong. I am definitely using Resolver. I can resolve via Diagnostics - DNS Lookup. The stats page seems to be randomly full or empty.

Resolver log shows:

Jan 23 21:36:20 	unbound 	78590:0 	info: start of service (unbound 1.8.1).
Jan 23 21:36:20 	unbound 	78590:0 	notice: init module 0: iterator

and those are the latest updates.

Interestingly, a manual nslookup shows the answering DNS server to be one of my AD DCs. Back when I first installed pfSense (2.1.x), I had it configured for DNS Forwarder, and I put my AD DNS into General Settings - DNS Servers. Later on, I disabled Forwarder and ran Resolver instead. Resolver is definitely NOT in forwarder mode. And yet it's still sending request to my DC.

johnpoz

If your an AD shop your clients should directly be asking your AD dns anyway... Have it forward to pfsense if you want.. But might as well just have your AD resolve, etc.

Do the command I asked before - lets see how many queries have been asked of unbound.

KOM

unbound-control -c /var/unbound/unbound.conf dump_infra

returns blank, and my stats page is back to No Data. So bizarre.