<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
.MsoChpDefault
{mso-style-type:export-only;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 70.85pt 2.0cm 70.85pt;}
div.WordSection1
{page:WordSection1;}
--></style></head><body lang=DE link=blue vlink="#954F72"><div class=WordSection1><p class=MsoNormal>Hi George,</p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Maybe it’s stupid but it still not completely clear for me. As Unbound knows when a particular entry Needs to be invalidated (based on the configuration it received upon load) Setting the TTL via EXPIRE would also work for the case you mentioned (serving outdated entries based on Unbound configuration). Maybe I am missing something?</p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>I have now created the following Setup:</p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Server 1:</p><p class=MsoNormal> Unbound (connected to KeyDB as backend)</p><p class=MsoNormal> KeyDB (Redis drop-in replacement with active replication, Bound to Server 2)</p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Server 2:<o:p></o:p></p><p class=MsoNormal> Unbound (connected to KeyDB as backend)<o:p></o:p></p><p class=MsoNormal> KeyDB (Redis drop-in replacement with active replication, Bound to Server 1)<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>That way every entry added by one of the Servers is automatically available also for the other one (active replication of KeyDB) => shared Cache <span style='font-family:"Segoe UI Emoji",sans-serif'>😊</span> Entries are evicted after 4 hours of idle time. Will Keep it that way for now and if it works well the next days this will become my productive setup.</p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Thanks all for your help!</p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Bye</p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Gesendet von <a href="https://go.microsoft.com/fwlink/?LinkId=550986">Mail</a> für Windows 10</p><p class=MsoNormal><o:p> </o:p></p><div style='mso-element:para-border-div;border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm'><p class=MsoNormal style='border:none;padding:0cm'><b>Von: </b><a href="mailto:unbound-users@lists.nlnetlabs.nl">George Thessalonikefs via Unbound-users</a><br><b>Gesendet: </b>Mittwoch, 12. Februar 2020 11:23<br><b>An: </b><a href="mailto:unbound-users@lists.nlnetlabs.nl">unbound-users@lists.nlnetlabs.nl</a><br><b>Betreff: </b>Re: AW: Unbound - Shared Cache</p></div><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Hi Peter,</p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>The reason is that you could serve expired records from that cache (if</p><p class=MsoNormal>you configure unbound to do so) so they shouldn't expire after the TTL.</p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>As for the recommended way to cleanup redis (from the man page):</p><p class=MsoNormal>"</p><p class=MsoNormal>It should be noted that Unbound never removes data stored in the Redis</p><p class=MsoNormal>server, even if some data have expired in terms of DNS TTL or the Redis</p><p class=MsoNormal>server has cached too much data; if necessary the Redis server must be</p><p class=MsoNormal>configured to limit the cache size, preferably with some kind of</p><p class=MsoNormal>least-recently-used eviction policy.</p><p class=MsoNormal>"</p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>I would recommend going through the cachedb section in the unbound.conf</p><p class=MsoNormal>man page as it also documents the behavior and some caveats such as the</p><p class=MsoNormal>"synchronous communication" between unbound and redis.</p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>As for the recommended way to cleanup redis I would look here:</p><p class=MsoNormal>https://redis.io/topics/lru-cache</p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>and probably use the 'allkeys-lru' policy.</p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Best regards,</p><p class=MsoNormal>-- George</p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>On 11/02/2020 19:53, Talkabout via Unbound-users wrote:</p><p class=MsoNormal>> Hi Benno,</p><p class=MsoNormal>> </p><p class=MsoNormal>> </p><p class=MsoNormal>> </p><p class=MsoNormal>> I have set up Unbound with redis Cache now and will check how well this</p><p class=MsoNormal>> works. I have one Question left: documentation states that unbound does</p><p class=MsoNormal>> NOT invalidate keys in the redis Cache even if they expire. Question</p><p class=MsoNormal>> from my side is why is unbound not simply using the „EXPIRE“ function of</p><p class=MsoNormal>> redis to set the TTL to the same time that unbound receives from an</p><p class=MsoNormal>> authority dns Server? That way no other maintenance Needs to be done. If</p><p class=MsoNormal>> there still is a valid reason (which I am sure there is 😊), what is the</p><p class=MsoNormal>> recommended way to cleanup redis?</p><p class=MsoNormal>> </p><p class=MsoNormal>> </p><p class=MsoNormal>> </p><p class=MsoNormal>> Thanks!</p><p class=MsoNormal>> </p><p class=MsoNormal>> </p><p class=MsoNormal>> </p><p class=MsoNormal>> Bye</p><p class=MsoNormal>> </p><p class=MsoNormal>> </p><p class=MsoNormal>> </p><p class=MsoNormal>> Gesendet von Mail <https://go.microsoft.com/fwlink/?LinkId=550986> für</p><p class=MsoNormal>> Windows 10</p><p class=MsoNormal>> </p><p class=MsoNormal>> </p><p class=MsoNormal>> </p><p class=MsoNormal>> *Von: *Talkabout via Unbound-users <mailto:unbound-users@lists.nlnetlabs.nl></p><p class=MsoNormal>> *Gesendet: *Montag, 10. Februar 2020 14:15</p><p class=MsoNormal>> *An: *Benno Overeinder <mailto:benno@NLnetLabs.nl>;</p><p class=MsoNormal>> unbound-users@lists.nlnetlabs.nl <mailto:unbound-users@lists.nlnetlabs.nl></p><p class=MsoNormal>> *Betreff: *AW: Unbound - Shared Cache</p><p class=MsoNormal>> </p><p class=MsoNormal>> </p><p class=MsoNormal>> </p><p class=MsoNormal>> Hi Benno,</p><p class=MsoNormal>> </p><p class=MsoNormal>> </p><p class=MsoNormal>> </p><p class=MsoNormal>> my real Name is Peter 😊</p><p class=MsoNormal>> </p><p class=MsoNormal>> </p><p class=MsoNormal>> </p><p class=MsoNormal>> Thank you very much for this hint, I will try to set up a redis Cache</p><p class=MsoNormal>> that distributes the entries among my servers.</p><p class=MsoNormal>> </p><p class=MsoNormal>> </p><p class=MsoNormal>> </p><p class=MsoNormal>> Bye</p><p class=MsoNormal>> </p><p class=MsoNormal>> </p><p class=MsoNormal>> </p><p class=MsoNormal>> Gesendet von Mail <https://go.microsoft.com/fwlink/?LinkId=550986> für</p><p class=MsoNormal>> Windows 10</p><p class=MsoNormal>> </p><p class=MsoNormal>> </p><p class=MsoNormal>> </p><p class=MsoNormal>> *Von: *Benno Overeinder <mailto:benno@NLnetLabs.nl></p><p class=MsoNormal>> *Gesendet: *Montag, 10. Februar 2020 13:50</p><p class=MsoNormal>> *An: *Talkabout <mailto:talk.about@gmx.de>;</p><p class=MsoNormal>> unbound-users@lists.nlnetlabs.nl <mailto:unbound-users@lists.nlnetlabs.nl></p><p class=MsoNormal>> *Cc: *Paul Vixie <mailto:paul@redbarn.org></p><p class=MsoNormal>> *Betreff: *Re: Unbound - Shared Cache</p><p class=MsoNormal>> </p><p class=MsoNormal>> </p><p class=MsoNormal>> </p><p class=MsoNormal>> Hi Talkabout (is this your real name?),</p><p class=MsoNormal>> </p><p class=MsoNormal>> </p><p class=MsoNormal>> </p><p class=MsoNormal>> Thank you Paul for your answer. Paul is correct that it is very</p><p class=MsoNormal>> dependent on your cache replacement algorithm and how to inform other</p><p class=MsoNormal>> resolvers that answers are already in cache.</p><p class=MsoNormal>> </p><p class=MsoNormal>> </p><p class=MsoNormal>> </p><p class=MsoNormal>> To answer your question, Talkabout, Unbound has a module for a shared</p><p class=MsoNormal>> cache with a Redis backend. It works as a secondary cache, 1) first</p><p class=MsoNormal>> local cache lookup, 2) shared cache lookup, 3) resolve/iterate. For</p><p class=MsoNormal>> configuration and use, see the unbound.conf(5) manpages, section "Cache</p><p class=MsoNormal>> DB Module Options". (You may have to compile Unbound yourself with the</p><p class=MsoNormal>> --with-libhiredis option.)</p><p class=MsoNormal>> </p><p class=MsoNormal>> </p><p class=MsoNormal>> </p><p class=MsoNormal>> Your suggestion to export/import the cache with unbound-control can be</p><p class=MsoNormal>> used for running Unbound clusters and you want to start a new Unbound</p><p class=MsoNormal>> instance with a hot cache.</p><p class=MsoNormal>> </p><p class=MsoNormal>> </p><p class=MsoNormal>> </p><p class=MsoNormal>> Best regards,</p><p class=MsoNormal>> </p><p class=MsoNormal>> </p><p class=MsoNormal>> </p><p class=MsoNormal>> — Benno</p><p class=MsoNormal>> </p><p class=MsoNormal>> </p><p class=MsoNormal>> </p><p class=MsoNormal>> </p><p class=MsoNormal>> </p><p class=MsoNormal>>> On 10 Feb 2020, at 12:21, Talkabout via Unbound-users</p><p class=MsoNormal>> <unbound-users@lists.nlnetlabs.nl> wrote:</p><p class=MsoNormal>> </p><p class=MsoNormal>>><o:p> </o:p></p><p class=MsoNormal>> </p><p class=MsoNormal>>> Hi Paul,</p><p class=MsoNormal>> </p><p class=MsoNormal>>> </p><p class=MsoNormal>> </p><p class=MsoNormal>>> thank you very much for your Statement!</p><p class=MsoNormal>> </p><p class=MsoNormal>>> </p><p class=MsoNormal>> </p><p class=MsoNormal>>> I am not that Deep into DNS logics so most likely not a very good</p><p class=MsoNormal>> communication Partner when the Topic becomes that complex 😊 I am using</p><p class=MsoNormal>> Unbound for my home Network only, there I think theoretical numbers like</p><p class=MsoNormal>> „hundreds cache misses per second“ are not that realistic. But I totally</p><p class=MsoNormal>> agree that making such a feature generic, this is something that Needs</p><p class=MsoNormal>> to be taken care of.</p><p class=MsoNormal>> </p><p class=MsoNormal>>> </p><p class=MsoNormal>> </p><p class=MsoNormal>>> Maybe a solution can be to integrate a Sub layer inbetween the local</p><p class=MsoNormal>> Cache and external resolvers, a shared Cache. This shared Cache is</p><p class=MsoNormal>> updated by all Peers when a query gets resolved and every peer can ask</p><p class=MsoNormal>> the shared Cache for entries when local Cache does not deliver any</p><p class=MsoNormal>> results. Shared Cache instances are then automatically synchronized.</p><p class=MsoNormal>> </p><p class=MsoNormal>>> </p><p class=MsoNormal>> </p><p class=MsoNormal>>> Obviously this Topic is not an easy one and it seems that there is</p><p class=MsoNormal>> Nothing in place I can reuse.</p><p class=MsoNormal>> </p><p class=MsoNormal>>> </p><p class=MsoNormal>> </p><p class=MsoNormal>>> Thanks again!</p><p class=MsoNormal>> </p><p class=MsoNormal>>> </p><p class=MsoNormal>> </p><p class=MsoNormal>>> Bye</p><p class=MsoNormal>> </p><p class=MsoNormal>>> </p><p class=MsoNormal>> </p><p class=MsoNormal>>> Gesendet von Mail für Windows 10</p><p class=MsoNormal>> </p><p class=MsoNormal>>> </p><p class=MsoNormal>> </p><p class=MsoNormal>>> Von: Paul Vixie</p><p class=MsoNormal>> </p><p class=MsoNormal>>> Gesendet: Montag, 10. Februar 2020 12:11</p><p class=MsoNormal>> </p><p class=MsoNormal>>> An: unbound-users@lists.nlnetlabs.nl</p><p class=MsoNormal>> </p><p class=MsoNormal>>> Cc: Talkabout</p><p class=MsoNormal>> </p><p class=MsoNormal>>> Betreff: Re: Unbound - Shared Cache</p><p class=MsoNormal>> </p><p class=MsoNormal>>> </p><p class=MsoNormal>> </p><p class=MsoNormal>>> On Monday, 10 February 2020 09:54:44 UTC Talkabout via Unbound-users</p><p class=MsoNormal>> wrote:</p><p class=MsoNormal>> </p><p class=MsoNormal>>> > I am using unbound on 2 different Servers (also populated bia DHCP as 2</p><p class=MsoNormal>> </p><p class=MsoNormal>>> > different Name Servers) and would like to make sure that if one Server</p><p class=MsoNormal>> </p><p class=MsoNormal>>> > already answered a query and cached it, the other does not Need to</p><p class=MsoNormal>> do the</p><p class=MsoNormal>> </p><p class=MsoNormal>>> > same query to the Internet again. ...</p><p class=MsoNormal>> </p><p class=MsoNormal>>> > Question is, if there is a standard way of doing this or any suggestions</p><p class=MsoNormal>> </p><p class=MsoNormal>>> > About the „best“ solution. Maybe somebody already has something like</p><p class=MsoNormal>> this</p><p class=MsoNormal>> </p><p class=MsoNormal>>> > working?</p><p class=MsoNormal>> </p><p class=MsoNormal>>> </p><p class=MsoNormal>> </p><p class=MsoNormal>>> this question has come up every year or so. one thing to know is that</p><p class=MsoNormal>> if this</p><p class=MsoNormal>> </p><p class=MsoNormal>>> is a good idea, then it would be a good multi-vendor idea, not just for</p><p class=MsoNormal>> </p><p class=MsoNormal>>> unbound, though unbound has a track record of doing things first that</p><p class=MsoNormal>> turn out</p><p class=MsoNormal>> </p><p class=MsoNormal>>> to be good ideas and end up standardized in DNS itself in some form.</p><p class=MsoNormal>> </p><p class=MsoNormal>>> </p><p class=MsoNormal>> </p><p class=MsoNormal>>> some open questions that relate to discard policy:</p><p class=MsoNormal>> </p><p class=MsoNormal>>> </p><p class=MsoNormal>> </p><p class=MsoNormal>>> if you had hundreds of cache misses per second which ones would you</p><p class=MsoNormal>> share with</p><p class=MsoNormal>> </p><p class=MsoNormal>>> your peer recursive nameservers? (maybe only share it after its first</p><p class=MsoNormal>> reuse? i</p><p class=MsoNormal>> </p><p class=MsoNormal>>> think the opendns anycast network uses a DHT for this, to inform peers of</p><p class=MsoNormal>> </p><p class=MsoNormal>>> availability of data, so it can be fetched from a peer if it's needed.)</p><p class=MsoNormal>> </p><p class=MsoNormal>>> </p><p class=MsoNormal>> </p><p class=MsoNormal>>> if your peer is sharing hundreds of cache misses per second with you,</p><p class=MsoNormal>> would</p><p class=MsoNormal>> </p><p class=MsoNormal>>> you ever discard something from your own cache to make room for</p><p class=MsoNormal>> something from</p><p class=MsoNormal>> </p><p class=MsoNormal>>> theirs? (generally this isn't the right thing, so you'd give your</p><p class=MsoNormal>> cache two</p><p class=MsoNormal>> </p><p class=MsoNormal>>> LRU quotas, one for your own cache misses, one for those shared to you.)</p><p class=MsoNormal>> </p><p class=MsoNormal>>> </p><p class=MsoNormal>> </p><p class=MsoNormal>>> when running at quota, and needing to discard something because a peer</p><p class=MsoNormal>> just</p><p class=MsoNormal>> </p><p class=MsoNormal>>> told you some new thing and you don't have room for N+1, would you choose</p><p class=MsoNormal>> </p><p class=MsoNormal>>> least recently learned (LRL) rather than least recently used (LRU) because</p><p class=MsoNormal>> </p><p class=MsoNormal>>> when things are used they've move from your peer-cache to your own-cache?</p><p class=MsoNormal>> </p><p class=MsoNormal>>> </p><p class=MsoNormal>> </p><p class=MsoNormal>>> other open questions:</p><p class=MsoNormal>> </p><p class=MsoNormal>>> </p><p class=MsoNormal>> </p><p class=MsoNormal>>> when using ECS, how do you know which cache additions to share, if</p><p class=MsoNormal>> your peer</p><p class=MsoNormal>> </p><p class=MsoNormal>>> or your peer's stubs don't have the same topology as you/yours do?</p><p class=MsoNormal>> </p><p class=MsoNormal>>> </p><p class=MsoNormal>> </p><p class=MsoNormal>>> would you rate limit the feed to a peer so as not to flood their capacity?</p><p class=MsoNormal>> </p><p class=MsoNormal>>> </p><p class=MsoNormal>> </p><p class=MsoNormal>>> this is a fascinating topic, as i hope you'll agree.</p><p class=MsoNormal>> </p><p class=MsoNormal>>> </p><p class=MsoNormal>> </p><p class=MsoNormal>>> --</p><p class=MsoNormal>> </p><p class=MsoNormal>>> Paul</p><p class=MsoNormal>> </p><p class=MsoNormal>> </p><p class=MsoNormal>> </p><p class=MsoNormal>> -- </p><p class=MsoNormal>> </p><p class=MsoNormal>> Benno J. Overeinder</p><p class=MsoNormal>> </p><p class=MsoNormal>> NLnet Labs</p><p class=MsoNormal>> </p><p class=MsoNormal>> https://www.nlnetlabs.nl/</p><p class=MsoNormal>> </p><p class=MsoNormal>> </p><p class=MsoNormal>> </p><p class=MsoNormal>> </p><p class=MsoNormal>> </p><p class=MsoNormal>> </p><p class=MsoNormal>> </p><p class=MsoNormal><o:p> </o:p></p></div></body></html>