<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/xhtml; charset=utf-8">
</head>
<body>
<div><div class="markdown">
<p dir="auto">On 2021-06-15 14:19:09 (+0800), Stefan Ubbink wrote:</p>
<blockquote>
<p dir="auto">On Tue, 15 Jun 2021 13:47:37 +0800<br />
Philip Paeps via Opendnssec-user <a href="mailto:opendnssec-user@lists.opendnssec.org">opendnssec-user@lists.opendnssec.org</a><br />
wrote:</p>
<blockquote>
<p dir="auto">On 2021-06-15 13:22:08 (+0800), Philip Paeps via Opendnssec-user<br />
wrote:</p>
<blockquote>
<p dir="auto">This is a zone we used to have a long time ago. It was deleted<br />
from zonelist.xml a long time ago (years). 'ods-enforcer zone<br />
list' does not know about this zone. So the database must have<br />
been updated. However .. 'ods-signer zones' does know about this<br />
zone. And it's trying to sign it apparently.</p>
<p dir="auto">There are a couple of other zones in this state.</p>
<p dir="auto">I have tried 'ods-signer update all' and 'ods-signer clear<br />
1.0.1.0.0.0.0.2.0.5.c.f.7.0.6.2.ip6.arpa'. Apparently to no avail.</p>
<p dir="auto">Is there a way to help ods-signer forget about these stale zones so<br />
our log files stop growing in vain?</p>
</blockquote>
<p dir="auto">I delete some files referencing these zones from<br />
/usr/local/opendnssec/var/{signer,signconf}. That seems to have<br />
changed the problem. I am not sure if this is a better or worse<br />
problem to have. The logs are now:</p>
<p dir="auto">Jun 15 05:40:47 ns-master ods-signerd[11051]: [file] unable to stat<br />
file<br />
/usr/local/var/opendnssec/signconf/1.0.1.0.0.0.0.2.0.5.c.f.7.0.6.2.ip6.arpa.xml:<br />
ods_fopen() failed Jun 15 05:40:47 ns-master ods-signerd[11051]:<br />
WARNING: unable to sign zone<br />
1.0.1.0.0.0.0.2.0.5.c.f.7.0.6.2.ip6.arpa, signconf is not ready Jun<br />
15 05:40:47 ns-master ods-signerd[11051]: back-off task [configure]<br />
for zone 1.0.1.0.0.0.0.2.0.5.c.f.7.0.6.2.ip6.arpa with 480 seconds<br />
I can restore those files from a ZFS snapshot if that makes the<br />
problem easier to solve. :)</p>
<p dir="auto">ods-signer zones still sees them, ods-enforcer zone list does not.<br />
ods-signer queue shows them, ods-enforcer queue does not.</p>
</blockquote>
<p dir="auto">Did you restart OpenDNSSEC (ods-control stop; ods-control start)?</p>
<p dir="auto">Before restarting ODS, you might want to write the new files for the<br />
signer using the <code>ods-enforcer signconf</code> command.</p>
</blockquote>
<p dir="auto">Yeah. I restarted the entire jail several times.</p>
<p dir="auto">But it looks like the problem was that we were stuck in a kind of intermediate state. I am guessing that ods-enforcer crashed while deleting the zones and that zones.xml file was not correctly updated.</p>
<p dir="auto">Looking through /usr/local/var/opendnssec, we seem to be carrying quite a lot of stale state around. That's probably going to haunt us when we least expect it.</p>
<p dir="auto">I wonder, is there an authoritative list of "intermediate" or "state" files OpenDNSSEC needs/wants/creates/tracks? While I'm watching this jail closely, I should take the opportunity to tidy up.</p>
<p dir="auto">Philip</p>
<p dir="auto">--<br />
Philip Paeps<br />
Senior Reality Engineer<br />
Alternative Enterprises</p>
</div></div>
</body>
</html>