Unbound - 100% CPU Utilization



  • Hello,

    I am experiencing random occurrences of 100% CPU utilization on unbound throughout the day.  I have DNSSEC enabled and hardened.  Here are the stats for my box:

    2.2.2-RELEASE (amd64)
    built on Mon Apr 13 20:10:22 CDT 2015
    FreeBSD 10.1-RELEASE-p9

    AMD G-T40E Processor
    2 CPUs: 1 package(s) x 2 core(s)

    Any assistance would be greatly appreciated.  As you can see from the logs the service starts rapidly stopping/starting, CPU goes to 100% for the process for 5-10 minutes, then it goes back to normal like nothing ever happened.

    I looked at my cron jobs and nothing really seems to line up with these times so it is quite confusing.  Also there is nothing extraordinary in the system log.

    Thanks!

    Dan
    Unbound_log_20150511.txt



  • Also, every time TOP refreshes the STATE for the unbound process changes in the following:

    RUN
    CPU1
    CPU0

    Over and over as it is at 100%.

    30153 unbound    1 102    0  262M  240M RUN    0  28:31  98.58% unbound

    Then:

    30153 unbound    1 103    0  262M  240M CPU1    1  28:04  98.88% unbound

    Then:

    30153 unbound    1 103    0  154M  134M CPU0    0  28:20  98.88% unbound



  • what packages do you have installed?



  • Hello,

    • Cron

    • Logstash-Forwarder (test package)

    • pfBlockerNG (have already looked through this with BBcan177)

    • Service Watchdog

    • softflowd

    • suricata



  • why do you have suricata why not use snort?

    I had service watchdog but I thought it was a bit of overkill. Im guessing its constantly monitoring your services which may cause CPU load maybe try to uninstall it for a day and see how it goes.
    And don't forget to reboot after (had an issue with squid one time)

    Also i had ntopng and I went from 26 percent to 60 percent CPU usage. Not sure if softflowd might be the case too but to figure out all possible outcomes I would also recommend uninstall it.

    CPU goes to 100% for the process for 5-10 minutes, then it goes back to normal like nothing ever happened.

    so your saying after 10mins of 100% it goes back down? and this happens for how long?