Unbound low cache hit rate

[John DeLuca]

Hello does anyone know why my unbound would be close to 40 cache misses I had a previous setup on my old router and I was close 90%+ hit rate. Could there be something wrong with my settings?

 

[Kingp1n]

Hello does anyone know why my unbound would be close to 40 cache misses I had a previous setup on my old router and I was close 90%+ hit rate. Could there be something wrong with my settings?

I believe it has something to do with new 3.0.0.6 firmware and/or if using GuestNetworkPro:

Thread 'After upgrading to firmware version 3006 that Unbound's hit rate has decreased?' https://www.snbforums.com/threads/a...6-that-unbounds-hit-rate-has-decreased.95001/

I haven't used Unbound in a while so i cant help much. See similar post

 

[Gary_Dexter]

What version of Unbound is installed?

 

[amplatfus]

It may also be related to the latest version of unbound package from Entware.
I have also lower cache percentage. The only change was update of Entware packages, without any changes to unbound.conf or firmware version.

 

[New2This]

Running latest here (1.23.0)

 

[Gary_Dexter]

Unbound made changes to the way serve-expired is now handled.

By default, the serve-expired-ttl is now 86400 seconds (rather than 0 - ie infinite), and serve-expired-client-timeout is now 1800ms (Time in milliseconds before replying to the client with expired data. This essentially enables the serve-stale behavior as specified in RFC 8767 that first tries to resolve before immediately responding with expired data. Setting this to 0 will disable this behavior and instead serve the expired record immediately from the cache before attempting to refresh it via resolution.)

This means if DNS can’t resolve with a “clean” reply within 1800ms it will then (and only then) serve the expired/cached reply.

 

[amplatfus]

Unbound made changes to the way serve-expired is now handled.

By default, the serve-expired-ttl is now 86400 seconds (rather than 0 - ie infinite), and serve-expired-client-timeout is now 1800ms (Time in milliseconds before replying to the client with expired data. This essentially enables the serve-stale behavior as specified in RFC 8767 that first tries to resolve before immediately responding with expired data. Setting this to 0 will disable this behavior and instead serve the expired record immediately from the cache before attempting to refresh it via resolution.)

This means if DNS can’t resolve with a “clean” reply within 1800ms it will then (and only then) serve the expired/cached reply.

Thank you for reply.
În my case I checked the backup of Unbound.conf before update to 1.23.0 and is the same with the current. In both I have:

serve-expired: yes
serve-expired-ttl: 86400

 

[Gary_Dexter]

Thank you for reply.
În my case I checked the backup of Unbound.conf before update to 1.23.0 and is the same with the current. In both I have:

serve-expired: yes
serve-expired-ttl: 86400

You need to override this one and set to 0 in your config, otherwise it will default to 1800ms:

serve-expired-client-timeout: 0

 

[bluzfanmr1]

You need to override this one and set to 0 in your config, otherwise it will default to 1800ms:

serve-expired-client-timeout: 0

That setting is not part of the default unbound.conf file, at least ours here. Does that mean it needs to be added?

 

[Gary_Dexter]

That setting is not part of the default unbound.conf file, at least ours here. Does that mean it needs to be added?

Yes.

Anything you don’t manually override in the Unbound config file will always use the default values as stipulated here:

unbound.conf(5) — Unbound 1.23.0 documentation

unbound.docs.nlnetlabs.nl

 

[bluzfanmr1]

Yes.

Anything you don’t manually override in the Unbound config file will always use the default values as stipulated here:

unbound.conf(5) — Unbound 1.23.0 documentation

unbound.docs.nlnetlabs.nl

Awesome, thanks for the tips. I have added that line.

 

[bluzfanmr1]

I can report after 1 hour with this change the cache hit % doubled to 50% and climbing. Surfing is back to what it used to be where it was zippy and there wasn't that pause with every click.

 

[amplatfus]

You need to override this one and set to 0 in your config, otherwise it will default to 1800ms:

serve-expired-client-timeout: 0

Thank you very much! This fixed my cache percentage. Now I am on max (83.5%) of last 7 days running unbound 1.23.0.
Thank you very much @John DeLuca for this thread.

 

[John DeLuca]

Happy to Help! I just did some tuning and added those setting ill see what happens in a few hours

 

[dave14305]

Is anyone even bothered by the idea that — for unknown reasons — you’re forced to serve expired DNS records to maintain an artificial cache hit rate?

Why aren’t these records refreshing themselves?

 

[Viktor Jaep]

Is anyone even bothered by the idea that — for unknown reasons — you’re forced to serve expired DNS records to maintain an artificial cache hit rate?

Why aren’t these records refreshing themselves?

Yes, and now I'm having trouble sleeping because of this. Thank you very much!!

 

[Viktor Jaep]

Running latest here (1.23.0)

View attachment 67026

Vanilla settings, no mods...

 

[Twiglets]

I am glad someone raised this point

Cache hits is not an absolute measure that Unbound is working 'Well'.

It is possible that your cache hits are lower because you happen to be accessing a large, varied and mostly distinct set of addresses.

Cache hits is a measure of how varied your DNS requests are ... If most people are accessing a small number of addresses regularly the cache hits will be 'Higher' otherwise 'Lower'.

A better measure of 'performance' is available by looking at the Unbound stats (See example below)

Unbound supports serving expired records following the RFC 8767 guidelines or if you set 'serve-expired-client-timeout: 0' it serves the cached 'expired' record immediately, before attempting normal resolution, this may increase client-side performance BUT is against the desirable intent of RFC 8767 to return expired answers ONLY as fallback for normal resolution.

See (from the Unbound Docs) ==> Serving Stale Data

 

[New2This]

View attachment 67043
Vanilla settings, no mods...

Mine is completely stock also, I have not made any changes to Unbound

 

[bluzfanmr1]

Is anyone even bothered by the idea that — for unknown reasons — you’re forced to serve expired DNS records to maintain an artificial cache hit rate?

Why aren’t these records refreshing themselves?

My understanding of Unbound was that it manages when to know to look for a refreshed record and that it doesn't need to look every single time. To me, it looked like the change was causing a lookup just about every time, slowing down DNS resolution on the network, and making Unbound like any other DNS option. When Unbound became an option here, we posted our Cache Hit % as a badge of honor. Perhaps that thinking is wrong or outdated nowadays?