Hello,
For a little while, I often see these kind of messages in knot:
oct. 18 06:49:12 arrakeen knotd[1636735]: error: [geekwu.org.] DNSSEC, failed to initialize signing context (PKCS #11 token not available)
When this happens, signature stops, and I only get notified by my monitoring when they're expired :/
Restarting knot is sufficent to get signing running again - no intervention needed on the HSM, the pkcs interface or anything like that.
Do you have an idea of what could happening? How to debug this? (I surely can monitor logs for this message, but it's kind of a pain)
Best regards,
BTW, here's my HSM:
# sudo -u knot pkcs11-tool --module /usr/lib/x86_64-linux-gnu/opensc-pkcs11.so --list-slots
Available slots:
Slot 0 (0x0): Nitrokey Nitrokey HSM (DENK01067960000 ) 00 00
token label : knot
token manufacturer : www.CardContact.dehttp://www.cardcontact.de/
token model : PKCS#15 emulated
token flags : login required, rng, token initialized, PIN initialized
hardware version : 24.13
firmware version : 3.4
serial num : DENK0106796
pin min/max : 6/15
uri : pkcs11:model=PKCS%2315%20emulated;manufacturer=www.CardContact.de;serial=DENK0106796;token=knot http://www.cardcontact.de;serial=denk0106796;token=knot/
Dear Knot developers,
Our Knot DNS systemd unit files do not currently have a "Type"
attribute, so it defaults to "simple". This works quite well. However,
we can set "Type" to one of "notify" or "notify-reload" for better
systemd integration.
For this, Knot DNS needs to support the READY=1, STOPPING=1, RELOADING=1
messages using sd_notify.
Could you please clarify which messages Knot DNS sends?
Regards,
Anand Buddhdev
RIPE NCC
Hello,
I see in the directory with zones and journal I see directories journal.<timestamp>.bak (same for keys and timers) and files journal.<timestamp>.export
time stamp and file date are the moment of upgrade from a knot compiled with lmdb0 to a knot compiled with lmdb1
Can I remove those files or directory ? (I suspect they are used during conversion of mdb files)
--
Erwan David
