why is named burning syslog?
 

We lost our internet connection today... and after a while I noticed that named was on fire... and so was syslogd, so I took a look at syslog and noticed that it was getting so big.... incredibly fast... it was almost ! Gb in just a couple of hours, I think... with messages from named saying that it could not get the address for a ROOT NS. (don't remember the message exactly).

What could be the problem? I guess it's because the network was down.... but how can I keep it from happening again?

(ubuntu 5.04)

It sounds like you don't have the hints for the root servers turned on. This is vitally important for any DNS server. I'm not sure how Ubuntu sets it up, but it's based on Debian, so I'll make a few assumptions.

Your /etc/bind/named.conf needs to have these lines in it:

zone "." {
type hint;
file "/etc/bind/db.root";
};

They should give Bind the info it needs to locate the root servers and works even if the network is down. It at least shouldn't complain to syslog every three seconds. Give it a try and tell me how it turns out.

I'll do it on monday as soon as I get to the office.... but if my memory is not wrong, that section is in the named.conf file. Tell you on monday anyway.

Well.. this is the follow up.

As told you, that section was in the configuration file:
This were the messages that were popping up in syslog:
See what I mean? All those messages were logged in less than a second. :-S

As I told you, I stopped bind till we got internet back. Once we got internet connection again, I started it again, with no problem... but I certainly don't want that to be a problem when our internet connection be down. Any other ideas?

can you post the output of db.root? there is obliviously something wrong about it. It's like your server can't resolv root server (you should NEVER try to resolv server of course, your server should know their name).

From my own db.root file :
For each "NS *.ROOT-SERVERS.NET" you should have a "A <ip>" line. Could you be missing the second one?

Your whishes are orders:

Why does it look like a dig response??? :-o