Unbound low cache hit rate

[John DeLuca]

Hello does anyone know why my unbound would be close to 40 cache misses I had a previous setup on my old router and I was close 90%+ hit rate. Could there be something wrong with my settings?

 

[Kingp1n]

Hello does anyone know why my unbound would be close to 40 cache misses I had a previous setup on my old router and I was close 90%+ hit rate. Could there be something wrong with my settings?

I believe it has something to do with new 3.0.0.6 firmware and/or if using GuestNetworkPro:

Thread 'After upgrading to firmware version 3006 that Unbound's hit rate has decreased?' https://www.snbforums.com/threads/a...6-that-unbounds-hit-rate-has-decreased.95001/

I haven't used Unbound in a while so i cant help much. See similar post

 

[Gary_Dexter]

What version of Unbound is installed?

 

[amplatfus]

It may also be related to the latest version of unbound package from Entware.
I have also lower cache percentage. The only change was update of Entware packages, without any changes to unbound.conf or firmware version.

 

[New2This]

Running latest here (1.23.0)

 

[Gary_Dexter]

Unbound made changes to the way serve-expired is now handled.

By default, the serve-expired-ttl is now 86400 seconds (rather than 0 - ie infinite), and serve-expired-client-timeout is now 1800ms (Time in milliseconds before replying to the client with expired data. This essentially enables the serve-stale behavior as specified in RFC 8767 that first tries to resolve before immediately responding with expired data. Setting this to 0 will disable this behavior and instead serve the expired record immediately from the cache before attempting to refresh it via resolution.)

This means if DNS can’t resolve with a “clean” reply within 1800ms it will then (and only then) serve the expired/cached reply.

 

[amplatfus]

Unbound made changes to the way serve-expired is now handled.

By default, the serve-expired-ttl is now 86400 seconds (rather than 0 - ie infinite), and serve-expired-client-timeout is now 1800ms (Time in milliseconds before replying to the client with expired data. This essentially enables the serve-stale behavior as specified in RFC 8767 that first tries to resolve before immediately responding with expired data. Setting this to 0 will disable this behavior and instead serve the expired record immediately from the cache before attempting to refresh it via resolution.)

This means if DNS can’t resolve with a “clean” reply within 1800ms it will then (and only then) serve the expired/cached reply.

Thank you for reply.
În my case I checked the backup of Unbound.conf before update to 1.23.0 and is the same with the current. In both I have:

serve-expired: yes
serve-expired-ttl: 86400

 

[Gary_Dexter]

Thank you for reply.
În my case I checked the backup of Unbound.conf before update to 1.23.0 and is the same with the current. In both I have:

serve-expired: yes
serve-expired-ttl: 86400

You need to override this one and set to 0 in your config, otherwise it will default to 1800ms:

serve-expired-client-timeout: 0

 

[bluzfanmr1]

You need to override this one and set to 0 in your config, otherwise it will default to 1800ms:

serve-expired-client-timeout: 0

That setting is not part of the default unbound.conf file, at least ours here. Does that mean it needs to be added?

 

[Gary_Dexter]

That setting is not part of the default unbound.conf file, at least ours here. Does that mean it needs to be added?

Yes.

Anything you don’t manually override in the Unbound config file will always use the default values as stipulated here:

unbound.conf(5) — Unbound 1.23.0 documentation

unbound.docs.nlnetlabs.nl

 

[bluzfanmr1]

Yes.

Anything you don’t manually override in the Unbound config file will always use the default values as stipulated here:

unbound.conf(5) — Unbound 1.23.0 documentation

unbound.docs.nlnetlabs.nl

Awesome, thanks for the tips. I have added that line.

 

[bluzfanmr1]

I can report after 1 hour with this change the cache hit % doubled to 50% and climbing. Surfing is back to what it used to be where it was zippy and there wasn't that pause with every click.