BIND 8.2.1 creating lots of CPU usage for syslogd and named

[Michael Voight]

I suspect a misconfiguration of syslog. So, further discussion on this
should be directed outside of this BIND group. To BIND, the queries are
valid.
To the original poster: Your syslog entry should ONLY reference a file
path, not a system name.

Michael

Jim Reid wrote:
> 
> >>>>> "Michael" == Michael Voight <mvoight at cisco.com> writes:
> 
>     Michael> Someone else mentioned earlier that it appeared syslog might be
>     Michael> recursively looking up the local hostname.  Syslog should not be
>     Michael> recursively doing name lookups. This might be because they told syslog
>     Michael> to log DNS queries. Since syslog is doing a dns query that needs to get
>     Michael> logged to syslog, the cycle never ends.
> 
> This is a reasonable explanation for such a high query rate of forward
> and reverse lookups of the local host name. A quick scan of the
> syslogd code suggests it does a forward and reverse lookup for each
> message if they arrive via syslogd's listener on port 514. This
> doesn't happen if the messages get delivered through /dev/log.