Automated Configuration Backup Fails To Upload
-
I am getting a message that my backup is failing to upload to the Netgate servers (which I have it set to do after every config change).
The message states that "acb.netgate.com" can't be resolved, but when I do a DNS resolution test, it resolves just fine? Please advise:
-
Do you see that error every time it tries to save?
How do you have the DNS configured in System > General setup?
You are only seeing a response from localhost/unbound in the test.Steve
-
@stephenw10 Thank you for the response. Yes, I see that error every time I make a config change.
I am only using Unbound/localhost for my DNS, and it is resolving the acb.netgate.home without any issues, so very strange.
-
So you have 'DNS Resolution Behavior' set to 'Use local DNS, ignore remote DNS servers'?
Can it resolve that if you test using host at the CLI?
-
@stephenw10 Yes, that's correct, I use local DNS and ignore downstream.
It resolves from the pfSense box and clients with no issues, so I'm not sure I believe the error message. Ping and traceroute output below:
Ping:
Traceroute:
-
Hmm, anything further logged in the system log?
-
@stephenw10 Actually, I do see an entry 15 or so minutes after my most recent change where the backup initiated, and I didn't get an error message.
Maybe it just tried to upload the backup too quickly following my config change, and all services weren't fully back up yet. I will keep an eye on it, and let you know if I see again - my only suggestion would be maybe to increase the time between the change and the upload?
-
What pfSense version is that?
ACB was changed to queue uploads asynchronously to allow for temporary issues.
-
@stephenw10 The latest and greatest - pfSense Plus 23.01, AMD64
-
Hmm, definitely applies there then. That would explain the log after 15mins, it will keep trying to upload queued backups. It must be failing for some other reason and just showing a resolution failure...
-
@stephenw10 That's what I'm thinking as well - thank you for your help!
-
Do you see anything in /tmp/backupdebug.txt ?
Is this new install? Upgrade to 23.01? What version was it running previously?
Steve
-
@stephenw10 I do not see a backupdebug.txt file in my tmp directory. I upgraded from 22.05 to 23.01 in February
-
And ACB has been working OK in 23.01 until recently?
-
@stephenw10 Honestly I haven't made many configuration changes in 23.01 - the ones I have made have failed initially, but I just got around to posting about it now.
I see all the backups, including a test I took yesterday that completed on the first try, so perhaps this is just an intermittent issue.
-
Ah, so it does actually backup? Hmm, that's even more weird then if it shows that error every time.
-
@stephenw10 For clarity, it does not back up on the attempt that I get the message for - but from what I saw in the logs, it retries 15 minutes later or so, and I get no error.
-
Ah, hmm. Do you see any other DNS resolution issues?
Are you using DNSoverTLS? With Quad9 perhaps? There seems to be an issue with that, as yet, undefined.
-
@stephenw10 No, no other DNS resolution issues to speak of, Unbound is typically rock solid. I do use DNS over SSL/TLS
To give you a better sense of my configuration - I have pfBlockerNG installed, so all traffic for all clients on my primary LAN Interface/VLANs go through Unbound, with no downstream server.
The only exception is my guest interface/VLAN used for wireless and IOT - the DHCP server on that Interface/VLAN is set up to dole out external DNS servers (starts with Cloudflare, then to Google, then to Quad9), and I have firewall rules in place to prevent that Interface from exchanging traffic with my primary VLANs. I was actually adding secondary Google DNS server and Quad9 to that DNS server list when I got this error - I wouldn't think that would affect the resolver, but I attempted to replicate the error by changing the order of the DNS servers in the DHCP settings for the Guest network.
The error did reoccur - see below for the logs, the resolver is not showing any issues, but it is showing that Unbound was restarted. The General log shows the error message about the config upload failing.
Unbound log:
General log:
It has been 1/2 hour now since I made that change, and the backup has not attempted to reupload. Also, as another datapoint, the backup didn't fail when I changed some UPS settings in NUT a few days ago.
-
@pdavis said in Automated Configuration Backup Fails To Upload:
I do use DNS over SSL/TLS
To Quad9?
That error sure looks like it actually failed to resolve. I can't see what else could trigger it.
