When unbound is running multiple threads, we have observed that queries where sent for each thread.
Since no user should have so much DNS traffic that more than one processor core is being saturated, this is a safe change.
Signed-off-by: Peter Müller peter.mueller@ipfire.org Signed-off-by: Arne Fitzenreiter arne.fitzenreiter@ipfire.org Signed-off-by: Michael Tremer michael.tremer@ipfire.org --- src/initscripts/system/unbound | 19 ------------------- 1 file changed, 19 deletions(-)
diff --git a/src/initscripts/system/unbound b/src/initscripts/system/unbound index c845c436f..1cf26ec0e 100644 --- a/src/initscripts/system/unbound +++ b/src/initscripts/system/unbound @@ -191,15 +191,6 @@ write_forward_conf() { write_tuning_conf() { # https://www.unbound.net/documentation/howto_optimise.html
- # Determine number of online processors - local processors=$(getconf _NPROCESSORS_ONLN) - - # Determine number of slabs - local slabs=1 - while [ ${slabs} -lt ${processors} ]; do - slabs=$(( ${slabs} * 2 )) - done - # Determine amount of system memory local mem=$(get_memory_amount)
@@ -234,16 +225,6 @@ write_tuning_conf() { ( config_header
- # We run one thread per processor - echo "num-threads: ${processors}" - echo "so-reuseport: yes" - - # Adjust number of slabs - echo "infra-cache-slabs: ${slabs}" - echo "key-cache-slabs: ${slabs}" - echo "msg-cache-slabs: ${slabs}" - echo "rrset-cache-slabs: ${slabs}" - # Slice up the cache echo "rrset-cache-size: $(( ${mem} / 2 ))m" echo "msg-cache-size: $(( ${mem} / 4 ))m"
This seems to cause that some resolvers do not respond to queries any more until unbound falls back.
To ensure better DNS performance, we disabled this.
Signed-off-by: Michael Tremer michael.tremer@ipfire.org --- config/unbound/unbound.conf | 1 - 1 file changed, 1 deletion(-)
diff --git a/config/unbound/unbound.conf b/config/unbound/unbound.conf index c78ca1db7..3aab6ea46 100644 --- a/config/unbound/unbound.conf +++ b/config/unbound/unbound.conf @@ -42,7 +42,6 @@ server: # Hardening Options harden-large-queries: yes harden-referral-path: yes - use-caps-for-id: yes aggressive-nsec: yes
# TLS