On 2021-06-15 13:22:08 (+0800), Philip Paeps via Opendnssec-user wrote:
This is a zone we used to have a long time ago. It was deleted from
zonelist.xml a long time ago (years). 'ods-enforcer zone list' does
not know about this zone. So the database must have been updated.
However .. 'ods-signer zones' does know about this zone. And it's
trying to sign it apparently.
There are a couple of other zones in this state.
I have tried 'ods-signer update all' and 'ods-signer clear
1.0.1.0.0.0.0.2.0.5.c.f.7.0.6.2.ip6.arpa'. Apparently to no avail.
Is there a way to help ods-signer forget about these stale zones so
our log files stop growing in vain?
I delete some files referencing these zones from
/usr/local/opendnssec/var/{signer,signconf}. That seems to have changed
the problem. I am not sure if this is a better or worse problem to
have. The logs are now:
Jun 15 05:40:47 ns-master ods-signerd[11051]: [file] unable to stat file
/usr/local/var/opendnssec/signconf/1.0.1.0.0.0.0.2.0.5.c.f.7.0.6.2.ip6.arpa.xml:
ods_fopen() failed
Jun 15 05:40:47 ns-master ods-signerd[11051]: WARNING: unable to sign
zone 1.0.1.0.0.0.0.2.0.5.c.f.7.0.6.2.ip6.arpa, signconf is not ready
Jun 15 05:40:47 ns-master ods-signerd[11051]: back-off task [configure]
for zone 1.0.1.0.0.0.0.2.0.5.c.f.7.0.6.2.ip6.arpa with 480 seconds
I can restore those files from a ZFS snapshot if that makes the problem
easier to solve. :)
ods-signer zones still sees them, ods-enforcer zone list does not.
ods-signer queue shows them, ods-enforcer queue does not.
Philip
--
Philip Paeps
Senior Reality Engineer
Alternative Enterprises
_______________________________________________
Opendnssec-user mailing list
[email protected]
https://lists.opendnssec.org/mailman/listinfo/opendnssec-user
