Switched to Python unbound Mode and now have issue

netblues

@mcfuzz Is python mode on in resolver?

RonpfS

@netblues said in Switched to Python unbound Mode and now have issue:

Re enabled python mode in resolver at this stage

You can not simply enable Python in DNS Resolver / General Settings tab, you have to do that in pfBlockerNG / DNSBL tab, then run a Force Update.

McFuzz

@netblues said in Switched to Python unbound Mode and now have issue:

@mcfuzz Is python mode on in resolver?

Yessir.

netblues

@ronpfs I did that, initially.
exactly as instructed!

RonpfS

@netblues Same result with a Force Reload All?

netblues

@ronpfs it does take time doing aaforce reload

RonpfS

@netblues 5-30 mins should be enough. But if some lists timeout after 5 mins, Update time can be much longer.

What kind of machine ? Under 4GB you have to limit the size of Feeds.

You may also have some lists that break DNSBL. Maybe disable all Groups and enable only one at a time to see if that complete fine.

Maybe something is running wild, was it rebooted lately?

netblues

@ronpfs @ 4Gigs, runs under kvm.
Disabled all tld option, for speedier updates.
I'm aware of lists overload et all. Without python mode, cron updates are normal, and force update complete in about 10-12 minutes.
Still, I can't enable python mode without loosing dns resolution.
So update fails due to no resolving.

Looks like a corner situation.

Gertjan

@netblues said in Switched to Python unbound Mode and now have issue:

about 10-12 minutes

That's ..... long. Slow connection ? Huge number of feeds ? Both ? Underpowered device ?
But even so, during the update, unbound - and the underlying extension python script, just takes a couple of seconds to restart. Surely non "10 minutes".

It's possible that the download saturates the download "pipe", so even DNS traffic suffers. All your traffic could suffer from this.
One of the reasons I update my feeds ones a week at 0300 AM. As most lists - you can see the date/time stamp info - is updated less often then that.

netblues

@gertjan Downloads are instant.
Filtering through 1m takes most of the time.
And no, the pipes are not saturated @100Mbits

And dns doesn't suffer overall.
If I get the dreaded error in resolver logs, no resolution is possible.
Ping with ip works great.

I need to experiment a bit more, but since this is service affecting during normal hours