unbound dns issues (logging, graphs and blocking)

[Vampier]

First of all: thanks for such a great open source firewall!

I updated from 22.7 to 23.1 manually and the parts that are supposed to work to get a stable connection still work.

However it seem that right after a vacuum command for a SQLLite3 database has been received the unbound logging that drives the graph and block log is not running anymore. Unbound works fine and there are no issues there.

Around 3:08 I see these messages in my logs.

2023-02-01T03:08:17-08:00   Notice   flowd_aggregate.py   vacuum done   
2023-02-01T03:08:17-08:00   Notice   flowd_aggregate.py   vacuum interface_086400.sqlite   
2023-02-01T03:08:17-08:00   Notice   flowd_aggregate.py   vacuum interface_003600.sqlite

This means that the database have been cleaned up and 'stray data' has been removed

But at that same moment the vacuum runs the logging stops for unbound queries which also results in a graph not being updated.

I also imported the same block list as I had running for my PiHole and it seems that it seems to ignore some block requests. I'm not sure why this happens but there might be a pattern match issue somewhere in the code (yes I double checked my block list)

Manually restarting unbound helps to get things moving again.

I have a replacement re-install (ProxMox) ready to go live at the end of the day but I'll keep my old instance in case there are questions with regards to logs or anything.

[Vampier]

[update] New instance running of opnSense restored with settings (no issues installing/restoring) will give an update if I run into the issue again

[opnfwb]

The logs you reference for flowd_aggregate are for the NetFlow logging that OPNsense supports. I don't think these are related to unbound.

I'm also running 23.1, have Unbound operational with all graphing working, and I also see those log messages in 23.1 and all prior legacy versions of OPNsense when I enabled NetFlow.

[Vampier]

I created a new opnSense proxmox instance and will see what happens - maybe something went wonky during the upgrade. It's too much of a coincidence that unbound graphs stop right when the databases are vacuumed don't you think?

Anyway - I limited my block list to 1 list for now to also see if that makes a difference.