Nov 11, 2025

Resident in-response – @@Dmitry Nourell @Leonid Evdokimov

Teleport and BKSP ID were unavailable for a few hours.

Teleport & BKSP ID Malfunction

Both services failed to perform DNS lookup during their normal operations. Error traced to Unbound service crash on OPNsense, leading to DNS resolve failure in the entire LAN segment.

OPNsense Unbound Malfunction

When @Dmitry Nourell opened OPNsense UI, Unbound service was stopped. Everything got back to normal after the service restart.

OOM killer killed unbound as it’s usually the largest process on the node: ≈260 MiB of RES due to huge DNS blocklists.
#TIL [zone: pf states] PF states limit reached due to traffic to ntppool NTP service.
#TIL syslog-ng sometimes takes as much as ≈1460 MiB of RES, shrinking down to 16 MiB awhile keeping SIZE at 1917M. Other noticed SIZE/RES spikes are: 909M / 153M, 909M / 394M; 1789M / 1427M; 1917M / 1461M.
That’s default syslog-ng 4 (4.8.1) from OPNsense 25.1.
The fishy behavior is long-time-ago overflown /var/log and truss showing repeated attempts to create month-old logs like /var/log/audit/audit_20251005.log on Nov12.

Action Points

✅ OPNsense 25.1 → 25.7

✅ node_exporter at uxie.int.bksp.in

✍️ stateless NAT for 0.ntp.bksp.in:123 to timekeeper.int.bksp.in:123: opnsense/core#9396

✍️ статистика pf для node_exporterhttps://10.0.2.1/

✍️ syslog-ng QA

✍️ /var/log/*/*_20??????.log rotation and/or compression