Named Load Issues - Looking for Advice

[Joseph]

Hello,

I'm looking for a bit of a push in the right direction - on one of our servers, named seems to be taking up an inordinate amount of system resources (both CPU and RAM).

I've been searching (both here and through Google) for individuals who seem to be having similar issues, with little luck.

I am hoping that someone here may have encountered a similar situation, and could point me in the right direction. I've heard a few people commenting that with the increased spam levels, their servers have been hit with a spike of DNS and MX records lookups, but I haven't been able to figure a way to measure that type of traffic, or to evaluate/moderate it if that is the case.

If anyone has any advice, I'd apprecaite the help.

Thanks,

Joseph

 

[superiorhost]

I have noticed the same on just one of our servers.
We are just now lookign into this.

Hopefully someone can shed some light on the subject.

Tim L

 

[AndyReed]

I have noticed the same on just one of our servers.
We are just now lookign into this.

Run the following command and see what processes are exhausting your server resources:
ps -efH |less

High server load has been covered many times in the past, although differ from one server to another. For example, one of our clients experienced a high server load with syslogd, last night. To fix the problem, we killed all syslogd processes and then started syslogd. Since then, every thing is back to normal.

 

[superiorhost]

Thanks Andy, I will give that a try and see what it shows.

I know it isn't as simple as killing bind and restarting.. done that already. Funny thing is, it never ran hard before moving to the new machine. Now it runs at 4 times the load with a server that is 4 times as strong. go figgure. The rest run great though.

I will give that a try. Thanks again.

Tim L

 

[superiorhost]

I am with Andy on this one... We know what is using the higher cpu load.. ( BIND) we just can't see why it is doing it. Before moving to this machine, with the same sites, it was not a problem.

Tim L

 

[Joseph]

Hi Andy,

Thanks for post Andy, however the issue isn't determining which processes are eating up the reasources (we've already determined that it's named that is doing so). The issues is keeping the process in check.

A simple reboot may work from time to time - but the recurring nature of it seems to point to a systemic problem, which I don't understand.

Thanks again,

Joseph

 

[brianoz]

I am with Andy on this one... We know what is using the higher cpu load.. ( BIND) we just can't see why it is doing it. Before moving to this machine, with the same sites, it was not a problem.

Just a thought; have you investigated whether it could be a Bind bug? Given that those sites (and exact same /var/named contents, right?) worked on another machine that's gotta be one of the most likely bets. You might be able to attach to it with ptrace or friends and see if it's looping somewhere crazy.

What release and version of the OS are you running? Have you compared your named copy against copies on similar OS & version machines?

 

[AndyReed]

processes are eating up the reasources (we've already determined that it's named that is doing so). The issues is keeping the process in check.

A simple reboot may work from time to time - but the recurring nature of it seems to point to a systemic problem, which I don't understand.

If your OS is FreeBSD, you might want to de-install and then re-install BIND. If not, did you check the log file: /var/log/messages for any clues as to why named failed?

 

[superiorhost]

Hi,
Thanks Brianoz,
I will look for a named bug and see if it is looping anywhere.

We are running CentOS 4.3 and bind 9.2.4 on al of them, but this is the only one with issues.
It isn't crashing.. just running a higher load than it should.

Thanks, We will try to find errors with it. Maybe do a reinstall on it and see if that will do the fix.

Tim L

 

[AndyReed]

It isn't crashing.. just running a higher load than it should.

Run this command and post the results:
rpm -qa | grep bind

 

[superiorhost]

Hi Andy,
Here it is:
bind-utils-9.2.4-2
bind-libs-9.2.4-2
bind-9.2.4-2

Now, in top, you can see the mem usage..
here is that line:
31244 named 20 0 201m 119m 1968 S ((29.2)) 3.0 985:23.08 named
On the other servers with about the same number of accounts, it is running around 10 on the memory usage. This one stays over 20 almost always.

THanks,
TIm L

 

[k1k]

Named Load

Hello,

You could simply disable the syslogd based logging and add external logging for your bind.
Then you will be able to see if there is something wrong with its configuration, or if there is something wrong with the access to your name server.