Unbound - error: reading root hints

Started by MoonbeamFrame, October 03, 2023, 06:50:13 PM

Previous topic - Next topic
I've had an issue with an OPNsense 23.7.5-amd64 firewall this morning.


Quote2023-10-03T09:53:18   Informational   unbound    [74018:a] info: generate keytag query _ta-4f66. NULL IN
2023-10-03T09:53:15   Notice   unbound    daemonize unbound dhcpd watcher.
2023-10-03T09:53:14   Critical   unbound    [74018:1] fatal error: Could not initialize thread
2023-10-03T09:53:14   Informational   unbound    [74018:1] info: server stats for thread 1: requestlist max 0 avg 0 exceeded 0 jostled 0
2023-10-03T09:53:14   Informational   unbound    [74018:0] info: start of service (unbound 1.18.0).
2023-10-03T09:53:14   Informational   unbound    [74018:1] info: server stats for thread 1: 0 queries, 0 answers from cache, 0 recursions, 0 prefetch, 0 rejected by ip ratelimiting
2023-10-03T09:53:14   Error   unbound    [74018:1] error: Could not set root or stub hints
2023-10-03T09:53:14   Error   unbound    [74018:1] error: reading root hints /root.hints 2:9: Syntax error, could not parse the RR's type

I believe from the time the error was logged until the firewall was rebooted DNS requests were not answered.
It appeared that I could not start, stop or restart it from the GUI and CPU usage was 15x normal. Though I could later see a log record showing that Unbound was stopped.

Before it was rebooted I was able to ssh into the firewall and could see that there was a /var/unbound/root.hints  file with a newer timestamp (~12:00) and that the contents matched the root.hints from another firewall.

I was wondering if there is a better/cleaner way to recover from this scenario?