Re: Recursive bind becomes unresponsive with high load

2016-04-01 Thread Mathew Ian Eis
A few thoughts: * You can check for dropped packets on the receive path with # netstat -u -s High numbers on "packet receive errors” can indicate an overflow in the receive buffer - this is fixable by network stack tuning as Mike Mitchell suggests. * You can check for dropped packets on the se

Re: Recursive bind becomes unresponsive with high load

2016-04-01 Thread /dev/rob0
On Fri, Apr 01, 2016 at 09:48:01PM +, Mike Mitchell wrote: > Have you checked the Kernel's connection tracking statistics? > Here's a link: > https://kb.isc.org/article/AA-01183/0/Linux-connection-tracking-and-DNS.html > > I've had to increase some network parameters on our busy > nameservers

Re: Recursive bind becomes unresponsive with high load

2016-04-01 Thread Mike Mitchell
Have you checked the Kernel's connection tracking statistics? Here's a link: https://kb.isc.org/article/AA-01183/0/Linux-connection-tracking-and-DNS.html I've had to increase some network parameters on our busy nameservers. I put the following in /etc/sysctl.conf net.netfilter.nf_conntrack_udp_t

Re: Recursive bind becomes unresponsive with high load

2016-04-01 Thread Michael Brunnbauer
Hello Mathew, On Fri, Apr 01, 2016 at 04:01:04PM +, Mathew Ian Eis wrote: > What OS are you running your BIND server on? Is it virtualized? Linux Kernel 3.4.111 with glibc 2.22, 32bit, not virtualized. No distribution - everything was compiled by hand. > Is it fully unresponsive, or could i

Re: Recursive bind becomes unresponsive with high load

2016-04-01 Thread Mathew Ian Eis
What OS are you running your BIND server on? Is it virtualized? Is it fully unresponsive, or could it be simply taking longer to respond than your client timeout? Cheers, Mathew Eis Northern Arizona University Information Technology Services mathew@nau.edu (928) 523-2960 -Origin

multi zone forward ?

2016-04-01 Thread lejeczek
hi everybody Is it possible with ISC to forward multiple zones to one(or a few) forwarders without declaring each zone separately? Something like with "view" or "policy" ? many thanks. L. ___ Please visit https://lists.isc.org/mailman/listinfo/bind-u

Re: BIND started replying to queries for .com with .COM

2016-04-01 Thread Phil Mayers
On 01/04/16 11:52, Niall O'Reilly wrote: If you are going to pick a single authority for a particular label, it should be the zone that determines whether that label exists or not. That seems no less arbitrary a rule of thumb than one which would give priority to the zone which contains

Re: Recursive bind becomes unresponsive with high load

2016-04-01 Thread Tony Finch
sth...@nethelp.no wrote: > > Have you checked your operating system limits? One recursive client > often means one open socket (waiting for response from authoritative > server), i.e. one open file descriptor. If you have thousands of > simultaneous recursive clients, you will need a corresponding

Re: BIND started replying to queries for .com with .COM

2016-04-01 Thread Niall O'Reilly
On 1 Apr 2016, at 11:08, Tony Finch wrote: > Robert Edmonds wrote: >> Tony Finch wrote: >>> Phil Mayers wrote: What is considered the source of the ownername for, say, "com."? >>> >>> It should be the root zone master file. >> >> Why not the com zone master file? > > If you are going

Re: BIND started replying to queries for .com with .COM

2016-04-01 Thread Tony Finch
Robert Edmonds wrote: > Tony Finch wrote: > > Phil Mayers wrote: > > > > > > What is considered the source of the ownername for, say, "com."? > > > > It should be the root zone master file. > > Why not the com zone master file? If you are going to pick a single authority for a particular label,