Linux Bind optimization for ISP server

sundialsvcs · 05-27-2016, 07:11 AM

I'm not sure why you've concluded that name-servers actually have anything at all to do with these symptoms.

dr.x · 05-27-2016, 07:16 AM

i understand that , but the location where am i , is 60 ms normally

i mean the 60 ms is naturally on my location

can you help on why the queries take like 120 ?

why don't take like 60 or 70 ms ??

cheers

dr.x · 05-27-2016, 07:25 AM

look @ the result below :

Quote:

[root@Dns-server2 ~]# dig www.linuxquestions.org @208.67.222.123

; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.37.rc1.el6_7.4 <<>> www.linuxquestions.org @208.67.222.123
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 16092
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;www.linuxquestions.org. IN A

;; ANSWER SECTION:
www.linuxquestions.org. 208 IN A 75.126.162.205

;; Query time: 62 msec
;; SERVER: 208.67.222.123#53(208.67.222.123)
;; WHEN: Fri May 27 07:42:24 2016
;; MSG SIZE rcvd: 56

[root@Dns-server2 ~]#

this result is 62 ms which i assume it great

but if do that command frequently ........... sometime i get high query time

like this

Quote:

[root@Dns-server2 ~]# dig www.linuxquestions.org @208.67.222.123

; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.37.rc1.el6_7.4 <<>> www.linuxquestions.org @208.67.222.123
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 41555
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;www.linuxquestions.org. IN A

;; ANSWER SECTION:
www.linuxquestions.org. 300 IN A 75.126.162.205

;; Query time: 152 msec
;; SERVER: 208.67.222.123#53(208.67.222.123)
;; WHEN: Fri May 27 07:43:56 2016
;; MSG SIZE rcvd: 56

the question here , do i need to check named service?
or
server performance ?

form now here is my kernel config :

Quote:

[root@Dns-server2 ~]# cat /etc/sysctl.conf
# Kernel sysctl configuration file for Red Hat Linux
#
# For binary values, 0 is disabled, 1 is enabled. See sysctl(8) and
# sysctl.conf(5) for more details.

# Controls IP packet forwarding
net.ipv4.ip_forward = 1

# Controls source route verification
net.ipv4.conf.default.rp_filter = 1

# Do not accept source routing
net.ipv4.conf.default.accept_source_route = 0

# Controls the System Request debugging functionality of the kernel
kernel.sysrq = 0

# Controls whether core dumps will append the PID to the core filename.
# Useful for debugging multi-threaded applications.
kernel.core_uses_pid = 1

# Controls the use of TCP syncookies
net.ipv4.tcp_syncookies = 1

# Disable netfilter on bridges.
net.bridge.bridge-nf-call-ip6tables = 0
net.bridge.bridge-nf-call-iptables = 0
net.bridge.bridge-nf-call-arptables = 0

# Controls the default maxmimum size of a mesage queue
kernel.msgmnb = 65536

# Controls the maximum size of a message, in bytes
kernel.msgmax = 65536

# Controls the maximum shared segment size, in bytes
kernel.shmmax = 68719476736

# Controls the maximum number of shared memory segments, in pages
kernel.shmall = 4294967296
################
fs.file-max = 1131072
net.local.dgram.recvspace = 1262144
net.local.dgram.maxdgram = 116384
net.netfilter.nf_conntrack_max = 1111130000
########################################
net.nf_conntrack_max = 1111131072
#########################################
####kernel: possible SYN flooding on port 80. Sending cookies.#####
net.ipv4.tcp_syncookies=0
#####################################

[root@Dns-server2 ~]#

here is my CPU about 20-40 %

Quote:

1 [#* 2.7%] 5 [#* 4.0%]
2 [#* 3.3%] 6 [#* 2.0%]
3 [# 0.7%] 7 [#* 1.3%]
4 [* 0.7%] 8 [* 0.7%]
Mem[|||#***************************** 357/7871MB] Tasks: 49, 19 thr; 1 running
Swp[ 0/3999MB] Load average: 0.00 0.00 0.00
Uptime: 23:22:48

PID USER PRI NI VIRT RES SHR S CPU% MEM% TIME+ Command
3564 named 20 0 737M 129M 2872 S 17.2 1.6 2h21:39 /usr/sbin/named -u named -4
3574 named 20 0 737M 129M 2872 S 3.3 1.6 30:42.35 /usr/sbin/named -u named -4
3568 named 20 0 737M 129M 2872 S 2.0 1.6 13:50.43 /usr/sbin/named -u named -4
3569 named 20 0 737M 129M 2872 S 2.0 1.6 13:50.70 /usr/sbin/named -u named -4
3570 named 20 0 737M 129M 2872 S 2.0 1.6 13:50.75 /usr/sbin/named -u named -4
3571 named 20 0 737M 129M 2872 S 2.0 1.6 13:50.61 /usr/sbin/named -u named -4
3572 named 20 0 737M 129M 2872 S 2.0 1.6 13:50.82 /usr/sbin/named -u named -4
3566 named 20 0 737M 129M 2872 S 1.3 1.6 13:50.75 /usr/sbin/named -u named -4
6398 root 20 0 110M 1924 1200 R 1.3 0.0 0:00.04 htop
3565 named 20 0 737M 129M 2872 S 1.3 1.6 13:51.48 /usr/sbin/named -u named -4
3567 named 20 0 737M 129M 2872 S 1.3 1.6 13:51.00 /usr/sbin/named -u named -4
1 root 20 0 19364 1532 1224 S 0.0 0.0 0:00.95 /sbin/init
478 root 16 -4 11040 1080 332 S 0.0 0.0 0:00.15 /sbin/udevd -d
1157 root 16 -4 27596 808 572 S 0.0 0.0 0:00.03 auditd
1156 root 16 -4 27596 808 572 S 0.0 0.0 0:00.13 auditd
1187 root 20 0 249M 1700 1048 S 0.0 0.0 1:35.96 /sbin/rsyslogd -i /var/run/syslogd.pid -c 5
1188 root 20 0 249M 1700 1048 S 0.0 0.0 1:42.79 /sbin/rsyslogd -i /var/run/syslogd.pid -c 5
1189 root 20 0 249M 1700 1048 S 0.0 0.0 0:00.00 /sbin/rsyslogd -i /var/run/syslogd.pid -c 5
1186 root 20 0 249M 1700 1048 S 0.0 0.0 3:18.78 /sbin/rsyslogd -i /var/run/syslogd.pid -c 5
1216 root 20 0 18372 744 464 S 0.0 0.0 0:10.33 irqbalance --pid=/var/run/irqbalance.pid
1261 rpc 20 0 18976 948 700 S 0.0 0.0 0:00.12 rpcbind
1281 rpcuser 20 0 23348 1336 888 S 0.0 0.0 0:00.01 rpc.statd
1398 dbus 20 0 21432 932 644 S 0.0 0.0 0:00.00 dbus-daemon --system
1417 root 20 0 184M 3784 2864 S 0.0 0.0 0:00.02 cupsd -C /etc/cups/cupsd.conf

is there any helpful statistics in bind itself to help ?

Quote:

[root@Dns-server2 ~]# /etc/init.d/named status
version: 9.8.2rc1-RedHat-9.8.2-0.37.rc1.el6_7.4
CPUs found: 8
worker threads: 8
number of zones: 19
debug level: 0
xfers running: 0
xfers deferred: 0
soa queries in progress: 0
query logging is OFF
recursive clients: 48/199900/200000
tcp clients: 0/100
server is up and running
named (pid 3564) is running...
[root@Dns-server2 ~]#

my named.conf file again :

Quote:

[root@Dns-server2 ~]# cat /etc/named.conf
////////////////////////////////////////
////////////////////////////////////////
options {
listen-on port 53 { 127.0.0.1; xxxxx; };
//////////////listen-on-v6 port 53 { ::1; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
allow-query { localhost; 1xxxxxx };
allow-query-cache { localhost; 1xxxxx; };
recursion yes;
////////////////Extend limits
recursive-clients 200000;
dnssec-enable no;
dnssec-validation no;
dnssec-lookaside auto;
forwarders { 208.67.222.123; 208.67.220.123; };
///forwarders { 8.8.8.8; 8.8.4.4; };

/* Path to ISC DLV key */
bindkeys-file "/etc/named.iscdlv.key";

managed-keys-directory "/var/named/dynamic";
};

logging {
channel default_debug {
file "data/named.run";
severity dynamic;
};
};

zone "." IN {
type hint;
file "named.ca";
};

/////////////////////
include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";

kind regards