Hi all,
recently I'm facing this issue which is more or less than two weeks that I've noticed but didn't take any precautions.

So I have a bind server (version 9.3.4-P1.2) running on a Debian 4.0 server.

The named process keeps wasting high cpu usage, averagely more than 50% all the time. Before it consumed less than 20 %.

The server is updated with the latest packages (apt-get update), and I don't know if it is a bug.

Can you help solving this issue.

Thanks,

Enid

how many zone files being served? how big are these zones??
What are the server specs??

run an strace on the pid
Is your bind server logging?? If so, does this give any clues??

There are 340 zones being served, the output of "rndc status" is:
# rndc status
number of zones: 340
debug level: 0
xfers running: 1
xfers deferred: 0
soa queries in progress: 1
query logging is OFF
recursive clients: 347/10000
tcp clients: 0/100
server is up and running


What do you mean with how big are the zones? They have averagely 6-8 records (SOA,MX,A,NS,TXT,CNAME)

Server specs:
#uname -a
Linux <hostname> 2.6.18-6-amd64 #1 SMP Sat Feb 20 23:34:55 UTC 2010 x86_64 GNU/Linux

CPU: Intel(R) Xeon(R) CPU 5130 @ 2.00GHz
RAM: 2GB
Swap: 4GB
HDD: 1.3TB Raid5 HW

I'm not sure about the arguments given to strace but the output of the command:
~# strace -c -d -t -p <pid>

is

Process 9636 attached - interrupt to quit
[wait(0x137f) = 9636]
pid 9636 stopped, [SIGSTOP]

"it hangs here, CTRL+C"

cleanup: looking at pid 9636
Process 9636 detached
% time seconds usecs/call calls errors syscall
------ ----------- ----------- --------- --------- ----------------
------ ----------- ----------- --------- --------- ----------------
100.00 0.000000 0 total


About logging it is not figuring in the named.conf and I give it
#rndc querylog to Toggle query logging.

and see the logs, but nothing special there , just a lot of resolving of records and no error that I can detect.



Thanks again,

Enid

run an strace against the pid..

run for a few mins then check the output.txt file
lets see if bind is doing anything it shouldnt be...maybe leaking memory..?

I ran the strace for about 1 minute and the output.txt file went around 280MB in size.

I cannot really understand very much its content for errors or something strange, also when I interrupted the strace, bind didn't resolve any more and the named process seemed stalled, I killed it and restart bind.

Where should I check for any errors on the output.txt?

After monitoring for some time the named process, and after some killing and restarting, now the load average and the cpu/ram usage seems lower than before, at the range of 20-40% cpu and 35% ram.

Maybe it was a DoS attack originating from a range of ip.

I'll keep monitoring and investigating more.

Rgds

I had a similar problem. Whilst I had already tried creating /var/named/dynamic to no avail, I had bind running as chroot and eventually realised I was creating the folder in the wrong place.

What I had to do (in Fedora 14) was:

cd /var/named/chroot/named
mkdir dynamic
chown -R named:named dynamic
service named restart

This reduced the CPU util on my machine from 99.7% to less than 1%, and means that name resolution is now far, far quicker.

I am facing the same issue, in my dns server, sometimes it works fine and on some days the CPU goes high and no domains resolve, someone plz give the solution.