<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><br class=""><div class=""><div><blockquote type="cite" class=""><div class="">Le 19 sept. 2022 à 18:15, dns--- via Unbound-users <<a href="mailto:unbound-users@lists.nlnetlabs.nl" class="">unbound-users@lists.nlnetlabs.nl</a>> a écrit :</div><br class="Apple-interchange-newline"><div class=""><meta http-equiv="Content-Type" content="text/html; charset=utf-8" class=""><div style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Hello, <div class=""><br class=""></div><div class="">We are preparing a special config of unbound which will allow one to use RPZ and benefit from a global GUI. </div><div class="">This will be embedded on firewall devices such as APU devices (4GB of RAM and 1GHz quad core AMD-G series ).</div><div class=""><br class=""></div><div class="">The zones we are dealing with could be of quite large size (largest is 468Mo) in size. </div><div class=""><br class=""></div><div class="">We have observed that after downloading the rpz files from our main RPZ server, It loads the server and uses ±3Go of RAM.</div><div class="">This seems quite strange because the total size of loaded RPZ files in the provided ex. below is 275Mo. </div><div class=""><br class=""></div><div class=""><br class=""></div><div class=""><div class="">last pid: 64525; load averages: 0.63, 0.57, 0.43 </div><div class="">up 0+03:03:48 16:05:00 35 processes: 2 running, 33 sleeping</div><div class="">CPU: 22.0% user, 0.0% nice, 9.1% system, 0.0% interrupt, 68.9% idle</div><div class="">Mem: 2263M Active, 752M Inact, 2316K Laundry, 422M Wired, 245M Buf, 481M Free</div><div class="">Swap: 764M Total, 60M Used, 703M Free, 7% Inuse</div></div><div class="">19073 unbound 4 52 0 2924M 2833M kqread 2 7:43 0.00% unbound</div><div class=""><br class=""></div><div class=""><br class=""></div><div class=""><br class=""></div><div class=""><b class=""><u class="">The questions are the following:</u></b> </div><div class=""><br class=""></div><div class="">1. Is there any specific parameters that we could use in order to minimise the RPZ memory impact ? </div><div class=""><br class=""></div><div class="">2. By default RPZ will use an AXFR zone transfer, can you confirm that this zone transfer is compressed ? (by RFC It should be)</div><div class=""><br class=""></div><div class="">3. What would you suggest as a general advise in order to tune the parameters (knowing that the zone content will change but not very often - like once a week)… </div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">These are the default parameters we are using: </div><div class=""><br class=""></div><div class=""><div class="">##</div><div class=""># Server configuration</div><div class="">##</div><div class="">server:</div><div class="">chroot: /var/unbound</div><div class="">username: unbound</div><div class="">directory: /var/unbound</div><div class="">pidfile: /var/run/unbound.pid</div><div class="">root-hints: /var/unbound/root.hints</div><div class="">use-syslog: yes</div><div class="">port: 53</div><div class="">verbosity: 1</div><div class="">extended-statistics: no</div><div class="">log-queries: yes</div><div class="">hide-identity: no</div><div class="">hide-version: no</div><div class="">harden-referral-path: no</div><div class="">do-ip4: yes</div><div class="">do-ip6: yes</div><div class="">do-udp: yes</div><div class="">do-tcp: yes</div><div class="">do-daemonize: yes</div><div class="">so-reuseport: yes</div><div class="">module-config: "iterator"</div><div class="">cache-max-ttl: 86400</div><div class="">cache-min-ttl: 0</div><div class="">harden-dnssec-stripped: no</div><div class="">serve-expired: no</div><div class="">outgoing-num-tcp: 10</div><div class="">incoming-num-tcp: 10</div><div class="">num-queries-per-thread: 4096</div><div class="">outgoing-range: 8192</div><div class="">infra-host-ttl: 900</div><div class="">infra-cache-numhosts: 10000</div><div class="">unwanted-reply-threshold: 0</div><div class="">jostle-timeout: 200</div><div class="">msg-cache-size: 4m</div><div class="">rrset-cache-size: 8m</div><div class="">num-threads: 4</div><div class="">msg-cache-slabs: 8</div><div class="">rrset-cache-slabs: 8</div><div class="">infra-cache-slabs: 8</div><div class="">key-cache-slabs: 8</div></div><div class=""><br class=""></div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">Thanks for your feedback. </div></div></div></blockquote><br class=""></div><div>Not so many answers for the time being… <div class=""><br class=""></div><div class="">A short follow-up to this thread. </div><div class=""><br class=""></div><div class=""><h1 class="op-uc-h1" style="font-size: 18px;">After couple of further tests:</h1><ul class="op-uc-list"><li class="op-uc-list--item">Loading zones will "occupy" the processor and put it at 100% for as long as all zones are loaded<ul class="op-uc-list"><li class="op-uc-list--item">About 8'30" to load 276Mo of RPZ zones (4920269 total zones)</li><li class="op-uc-list--item">Once loaded the processor is at 2924Mo usage</li><li class="op-uc-list--item">and the load is at 80% globally</li></ul></li></ul><p class="op-uc-p">I have read this thread: <a class="op-uc-link" href="https://github.com/NLnetLabs/unbound/issues/318">https://github.com/NLnetLabs/unbound/issues/318</a></p><p class="op-uc-p">There don't seem to be any memory leak, simply a very slow loading process and a huge usage of memory.</p><p class="op-uc-p">Most probably this is not so optimized in memory.</p><p class="op-uc-p"><br class=""></p><h2 class="op-uc-h2">Comparison with bind</h2><p class="op-uc-p">As a comparison, the process loaded on our bind9 (master RPZ server) serves zones for 18063096 total zones and uses 8245348 bytes</p><p class="op-uc-p">So about 8Go or RAM usage.</p><p class="op-uc-p">So the bind9 has a memory performance ratio of : 2190,8</p><p class="op-uc-p">While the unbound has a memory performance ratio of: 1682,7 also the loading process is way faster. </p><p class="op-uc-p"><br class=""></p><p class="op-uc-p">In other word : I think we should advise using our filtering with firewall devices with a minimum of 8Go of RAM (and this is a real minimum).</p><div class=""><br class=""></div><div class="">If anyone can come up with a way to optimise this specially the loading process. </div><div class="">I'd be happy to read the comments. </div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">Sincerely yours. </div></div></div><div><br class=""></div><br class=""><div class="">
<meta charset="UTF-8" class=""><div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); font-family: Menlo; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; text-decoration: none;">—<br class=""></div><span><img apple-inline="yes" id="CE31DA20-ECC6-4417-8553-0451CAA2AF3D" src="cid:9074469A-93B0-41E4-80A1-3D36C1A3F8EA" class=""></span>
</div>
<br class=""></div></body></html>