BIND 8.2.1 creating lots of CPU usage for syslogd and named

[Michael van Elst]

"Marcel Janssen" <maja at oce.nl> writes:

>Hi,

>I'm running BIND 8.2.1 on Solaris 2.6

>When I start named SYSLOGD and NAMED are using
>lots of CPU.

>This is some output from top
>  167 root      10  33  0 4136K 1984K sleep  21.1H 45.70% syslogd
>6721 root       1   7    0 4312K 1888K sleep     0:18 16.45% named

>When I turn on querylogging I get this about 200 times a second
>08-Aug-1999 13:57:42.559 XX+/134.188.149.78/78.149.188.134.in-addr.arpa/PTR
>08-Aug-1999 13:57:42.561 XX+/134.188.149.78/ts1-st16.oce.nl/A

>In which 134.188.149.78 is the ip adres and ts1-st16.oce.nl is the hostname
>running NAMED. Thus it performs about 200 queries a second for its own
>ip/hostname.

>Can anybody help me?


Apparently the machine doesn't know its own name without querying
the nameserver. This often means that you haven't entered the
name into /etc/hosts, but more likely, you use a search order
of 'hosts: dns, files' or only 'hosts: dns' in /etc/nsswitch.conf.

The result ist that syslog tries to resolve the origin of each
log message and thus creates a new query and a new log message
in an endless recursion.


-- 
                                Michael van Elst

Internet: mlelstv at serpens.swb.de
                                "A potential Snark may lurk in every tree."