<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /></head><body style='font-size: 10pt; font-family: Verdana,Geneva,sans-serif'>
<div class="pre" style="margin: 0; padding: 0; font-family: monospace">Hi all,<br /> <br /> I would like to get opinion on issue I was involved over weekend.<br /> Customer utilizes RPZ feed from spamhaus and worked pretty OK for some months after initial deployment.<br /> They reported issue with wrong performance of BIND DNS;</div>
<div class="pre" style="margin: 0; padding: 0; font-family: monospace">BIND version: 9.10.8-P1</div>
<div class="pre" style="margin: 0; padding: 0; font-family: monospace"> </div>
<div class="pre" style="margin: 0; padding: 0; font-family: monospace">I observed BIND CPU usage went from 5% to ~200% CPU non stop; noticing slow processing of UDP with timeout for dig output;<br /> netstat confirmed that udp4 queue is not processed on time.<br /> <br /> ZE RES STATE C TIME WCPU COMMAND<br />1050 named 8 20 0 4058M 3261M sigwai 0 114.7H 182.67% named<br /> <br /> After different looks and restart of BIND which temporary resolve issue for few minutes, I notice journal error on BIND<br /> <br /> <em>May 17 22:11:46 DNS named[60244]: zone dbl.rpz.spamhaus.org/IN: journal file is out of date: removing journal file</em><br /> <br /> So I started to suspect some weird state with this RPZ<br /> <br /> <br /> Look on last 3 transfer; 2 looks OK, last one is weird with 5 record and slow processing - I see also change for (re)loading policy name which was new for me.<br /> <br /> <em>May 17 20:47:10 DNS named[1050]: zone dbl.rpz.spamhaus.org/IN: Transfer started.</em><br /><em> May 17 20:47:11 DNS named[1050]: transfer of 'dbl.rpz.spamhaus.org/IN' from 199.168.90.51#53: connected using 10.192.176.53#28493</em><br /><em> May 17 20:47:11 DNS named[1050]: zone dbl.rpz.spamhaus.org/IN: transferred serial 1558140361</em><br /><em> May 17 20:47:11 DNS named[1050]: transfer of 'dbl.rpz.spamhaus.org/IN' from 199.168.90.51#53: Transfer status: success</em><br /><em> May 17 20:47:11 DNS named[1050]: transfer of 'dbl.rpz.spamhaus.org/IN' from 199.168.90.51#53: Transfer completed: 1 messages, 154 records, 3234 bytes, 0.017 secs (190235 bytes/sec)</em><br /> <br /> <br /><em> May 17 20:51:38 DNS named[1050]: zone dbl.rpz.spamhaus.org/IN: Transfer started.</em><br /><em> May 17 20:51:38 DNS named[1050]: transfer of 'dbl.rpz.spamhaus.org/IN' from 199.168.90.51#53: connected using 10.192.176.53#56279</em><br /><em> May 17 20:51:38 DNS named[1050]: zone dbl.rpz.spamhaus.org/IN: transferred serial 1558140601</em><br /><em> May 17 20:51:38 DNS named[1050]: transfer of 'dbl.rpz.spamhaus.org/IN' from 199.168.90.51#53: Transfer status: success</em><br /><em> May 17 20:51:38 DNS named[1050]: transfer of 'dbl.rpz.spamhaus.org/IN' from 199.168.90.51#53: Transfer completed: 3 messages, 1244 records, 25623 bytes, 0.037 secs (692513 bytes/sec)</em><br /> <br /><em> May 17 20:55:51 DNS named[1050]: zone dbl.rpz.spamhaus.org/IN: Transfer started.</em><br /><em> May 17 20:55:51 DNS named[1050]: transfer of 'dbl.rpz.spamhaus.org/IN' from 199.168.90.51#53: connected using 10.192.176.53#25939</em><br /><em> May 17 20:55:52 DNS named[1050]: (re)loading policy zone 'dbl.rpz.spamhaus.org' changed from 5940230 to 5 qname, 0 to 0 nsdname, 886 to 874 IP, 0 to 0 NSIP, 0 to 0 CLIENTIP entries</em><br /><em> May 17 20:55:53 DNS named[1050]: zone dbl.rpz.spamhaus.org/IN: transferred serial 1558140721</em><br /><em> May 17 20:55:53 DNS named[1050]: transfer of 'dbl.rpz.spamhaus.org/IN' from 199.168.90.51#53: Transfer status: success</em><br /><em> May 17 20:55:53 DNS named[1050]: transfer of 'dbl.rpz.spamhaus.org/IN' from 199.168.90.51#53: Transfer completed: 1 messages, 5 records, 310 bytes, 2.251 secs (137 bytes/sec)</em><br /> </div>
<div class="pre" style="margin: 0; padding: 0; font-family: monospace"> </div>
<div class="pre" style="margin: 0; padding: 0; font-family: monospace">====</div>
<div class="pre" style="margin: 0; padding: 0; font-family: monospace"> </div>
<div class="pre" style="margin: 0; padding: 0; font-family: monospace">Above would be just interesting event on one DNS server, but I got another DNS report issue from completely different customer same day later.</div>
<div class="pre" style="margin: 0; padding: 0; font-family: monospace">Common:</div>
<ul>
<li class="pre">same RPZ feed configured</li>
<li class="pre">issue happened after transferring same serial - <em>1558140721</em></li>
</ul>
<p><em></em>On other side, it was just one server from 2 for each customer, so I cannot say it impacted directly each server used by this feed.</p>
<p>===</p>
<p>In both cases, we deconfigure RPZ feed which resolved issue immediately without any restart, we did just rndc reload after removing RPZ statements for this feed.</p>
<p>Due production state, was not easy to take more valuable data and that's first part I would like to ask audience for guideline.</p>
<p>Best Regards,<br />Peter</p>
</body></html>