Determining cause of unbound failure, rapidfire service restarts

packagingrichard

I just had unbound fail on my Netgate 6100, but came back up as soon as I manually started the service. It was only down a few minutes before a user tagged me, so this incident wasn't a big deal but I'd like to get to the root of it in case it happens when I'm unreachable.

Nothing notable that I can deterine in the logs EXCEPT these lines (I'll attach a full log if someone thinks it'd be helpful) a ton of unbound restarts before failures to resolve crop up.
After restarting unbound, I'm still getting an unbound restart every minute, is that normal?

Oct 16 09:57:50	unbound	51014	[51014:0] notice: Restart of unbound 1.17.1.
Oct 16 09:58:10	unbound	51014	[51014:0] notice: Restart of unbound 1.17.1.
Oct 16 09:58:47	unbound	51014	[51014:0] notice: Restart of unbound 1.17.1
Oct 16 09:59:27	unbound	51014	[51014:0] notice: Restart of unbound 1.17.1.
Oct 16 10:00:27	unbound	51014	[51014:0] notice: Restart of unbound 1.17.1.
Oct 16 10:00:31	unbound	51014	[51014:0] notice: Restart of unbound 1.17.1.
Oct 16 10:00:51	unbound	51014	[51014:0] notice: Restart of unbound 1.17.1.
Oct 16 10:00:55	unbound	51014	[51014:0] notice: Restart of unbound 1.17.1.
Oct 16 10:04:22	filterdns	71018	failed to resolve host [redacted] will retry later again.
Oct 16 10:04:22	filterdns	71018	failed to resolve host [redacted] will retry later again.
Oct 16 10:04:22	filterdns	71018	failed to resolve host [redacted] will retry later again.
Oct 16 10:04:22	filterdns	71018	failed to resolve host [redacted] will retry later again.

bmeeks

Two things come to mind immediately that can result in unbound restarts.

Having the DHCP server register hostnames in DNS. Some IoT devices can do really dumb stuff like renewing their lease very very often. Because of an unbound limitation in pfSense, the only way to have the new DHCP host leases be resolvable is to restart the unbound daemon each time DHCP issues a new host lease (if you have "register leases in DNS" enabled under the DHCP Server configuration).
pfBlockerNG, if installed, can restart unbound when certain of its features are enabled, but generally that would not be every minute unless you chose some extremely short list update interval.

Obviously if unbound is frequently restarting, that is going to cause DNS issues because the daemon can't resolve when it's not running and instead is being restarted.