Bind is killing my server!

[mr.wonderful]

Im having issue with NAMED running at close to 90%. Its been doing this for a number of days. Anyone else notice this?

[edesignway]

Look in the /var/log/messages and check if there are a lot of lame nameserver entries.

Look at the bandmin reports, see if you notice heavy traffic on one or two IP addresses that shouldn't be there.


I had this same problem, when my datacenter assigned me my last /26 two of those IP addresses were still assigned to somebody's nameservers which was then assigned to four domains, these four domains were sending so many requests to my server (trying to access the mail server to send our SPAM) that BIND was running between 30 and 90% CPU usage.

I solved this problem by asking my datacenter to null route the IPs (I am sure there are other methods of fixing the problem, but I didn't wan't the hassle, wanted to prevent all traffic from these domains from reaching the server.)

Regards,
Tim