named 4.9.3P1 uses a lot CPU?

[Chin Fang]

We run BIND 4.9.3 P1 on a SS1 with 64 MB. It's a primary name server.
Recently I have noticed that its consuming constantly anywhere from
19 - 35 % of the CPU as reported by top(1).

Puzzled, I tried to turn on query logging using SIGWINCH. However,
the /var/log/syslog didn't show anything (I can't remember when I
compiled it, whether I enabled this feature or not. The src was
archived and I have to dig it out). I also checked /usr/adm/messages,
other than a lot lame delegation entries (always got these :(, didn't
see anything unusual. I don't have any zone Expire/Minimum set very
low either.

I also checked RAM usage, there are still memory left (also reported by
top(1)).

Finally, we have some web servers here, but their HTTPD is compiled
with minimum DNS, so the web servers shouldn't be banging on the name
server very much. They are moderately busy, getting anywhere from
150 - 200 k hits/day.

I also checked sendmail running on each machine as the last resort,
didn't see any abnormality either.

I would appreciate it very much for any hints about where to further
look for possible causes. As far as I can recall, this named never
consumed so much CPU before.

Thanks,

Chin Fang
fang...@jessica.stanford.edu

[Rich Martin]

Chin:

I would turn on debugging...SIGUSR1 I think, the debug output
will probably go to /usr/tmp/named.run...then take a look at what types
of queries your getting...I saw this problem before when my nameserver
was getting hit by about 200 queries per second by some incorrectly
configured host.

Rich Martin
<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<-*->>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
InoTech
2222 Gallows Road Suite #300
Tysons Corner, Virginia 22027
(703) 641-0469
(703) 641-0206 FAX
in...@inotech.com
http://www.inotech.com