<html><head></head><body><div class="ydpb3e328bfyahoo-style-wrap" style="font-family:Helvetica Neue, Helvetica, Arial, sans-serif;font-size:16px;"><div></div>
<div dir="ltr" data-setdir="false">Hey again,</div><div dir="ltr" data-setdir="false"><br></div><div dir="ltr" data-setdir="false">I tried setting the following timeouts, hoping to achieve an improvement:<br><br><div><div> max-transfer-idle-in 5;</div><div> max-transfer-idle-out 5;</div><div> max-transfer-time-in 5;</div><div> max-transfer-time-out 5;</div></div><br></div><div dir="ltr" data-setdir="false">But this did neither decrease the amount of open outgoing connections, nor did it shorten the time, they stay open.</div><div dir="ltr" data-setdir="false"><br></div><div dir="ltr" data-setdir="false">Anything else I can try?</div><div dir="ltr" data-setdir="false"><br></div><div dir="ltr" data-setdir="false">Cheers<br>Marno</div><div dir="ltr" data-setdir="false"><br></div><div dir="ltr" data-setdir="false"><br></div>
</div><div id="ydp945d0a46yahoo_quoted_8027617927" class="ydp945d0a46yahoo_quoted">
<div style="font-family:'Helvetica Neue', Helvetica, Arial, sans-serif;font-size:13px;color:#26282a;">
<div>
Am Donnerstag, 3. November 2022 um 10:16:12 MEZ hat Marno Krahmer via bind-users <bind-users@lists.isc.org> Folgendes geschrieben:
</div>
<div><br></div>
<div><br></div>
<div><div id="ydp945d0a46yiv8412743244"><div><div style="font-family:Helvetica Neue, Helvetica, Arial, sans-serif;font-size:16px;" class="ydp945d0a46yiv8412743244yahoo-style-wrap"><div dir="ltr"><div><div dir="ltr" style="font-family:Helvetica, Arial, sans-serif;font-size:16px;"><div><div style="color:rgb(0, 0, 0);font-family:Verdana;font-size:12px;">Hey,</div><div style="color:rgb(0, 0, 0);font-family:Verdana;font-size:12px;"> </div><div style="color:rgb(0, 0, 0);font-family:Verdana;font-size:12px;">a few days ago I upgraded multiple DNS-Servers from version 9.16.1-0ubuntu2.11 to 9.18.1-1ubuntu1.2 (And from Ubuntu 20.04 to Ubuntu 22.04) and observed a change in behavior that I am not able to explain.</div><div style="color:rgb(0, 0, 0);font-family:Verdana;font-size:12px;">There was no change in the bind configuration being used. While operating bind 9.16 and bind 9.18 in parallel, I can only see the increase in open files / sockets on machines running bind 9.18. The amount of open files / sockets using bind 9.16 seems to be consistent.<br><br>This issue can be seen on those graphs:</div></div><div style="color:rgb(0, 0, 0);font-family:Verdana;font-size:12px;"><br></div><div style="color:rgb(0, 0, 0);font-family:Verdana;font-size:12px;"><div class="ydp945d0a46yiv8412743244ydpab8034d0img-preview-wrapper"><img title="Inline-Bild" alt="Inline-Bild" src="cid:PKhvrQXk3ztKVqatcTe6" style="max-width:800px;width:800px;" class="ydp945d0a46yiv8412743244ydpab8034d0yiv4763404164yahoo-inline-image ydp945d0a46yiv8412743244ydpab8034d0preview" data-id="<ccc4df51-8d7d-8721-5561-32235a68d492@yahoo.com>"><span style="background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-attachment:initial;border:1px solid rgb(130, 140, 147);border-radius:2px;" class="ydp945d0a46yiv8412743244ydpab8034d0img-dl-btn"><button tabindex="-1" title="Herunterladen" class="ydp945d0a46yiv8412743244ydpab8034d0c27KHO0_n ydp945d0a46yiv8412743244ydpab8034d0b_0 ydp945d0a46yiv8412743244ydpab8034d0M_0 ydp945d0a46yiv8412743244ydpab8034d0i_0 ydp945d0a46yiv8412743244ydpab8034d0I_T ydp945d0a46yiv8412743244ydpab8034d0y_Z2hYGcu ydp945d0a46yiv8412743244ydpab8034d0A_6EqO ydp945d0a46yiv8412743244ydpab8034d0r_P ydp945d0a46yiv8412743244ydpab8034d0C_q ydp945d0a46yiv8412743244ydpab8034d0cvhIH6_T ydp945d0a46yiv8412743244ydpab8034d0P_eo6"><span style="width:20px;" class="ydp945d0a46yiv8412743244ydpab8034d0D_F ydp945d0a46yiv8412743244ydpab8034d0ab_C ydp945d0a46yiv8412743244ydpab8034d0gl_C ydp945d0a46yiv8412743244ydpab8034d0W_6D6F"></span></button></span></div><br><br></div><div style="color:rgb(0, 0, 0);font-family:Verdana;font-size:12px;"><br></div></div><div dir="ltr" style="font-family:Helvetica, Arial, sans-serif;font-size:16px;"><div style="color:rgb(0, 0, 0);font-family:Verdana;font-size:12px;">Those graphs show the amount of open file descriptors by the bind process.</div><div style="color:rgb(0, 0, 0);font-family:Verdana;font-size:12px;"> </div><div style="color:rgb(0, 0, 0);font-family:Verdana;font-size:12px;">While investigating the logs, I was able to correlate the grows in file descriptors with those log messages:</div><div style="color:rgb(0, 0, 0);font-family:Verdana;font-size:12px;"> </div><div style="color:rgb(0, 0, 0);font-family:Verdana;font-size:12px;">28-Oct-2022 03:19:49.384 general: info: zone sub.<mydomain.com>/IN/inside: notify from 10.12.34.52#53821: serial 1541576593<br>28-Oct-2022 03:20:08.428 general: info: zone sub.<mydomain.com>/IN/inside: notify from 10.12.34.52#45864: serial 1541576594<br>28-Oct-2022 03:20:17.389 general: info: zone sub.<mydomain.com>/IN/inside: notify from 10.12.34.52#45864: serial 1541576595<br>28-Oct-2022 03:21:16.257 general: info: zone sub.<mydomain.com>/IN/inside: notify from 10.12.34.52#54654: serial 1541576596<br>28-Oct-2022 03:24:30.641 general: info: zone sub.<mydomain.com>/IN/inside: notify from 10.12.34.52#36460: serial 1541576598<br>28-Oct-2022 03:24:35.641 general: info: zone sub.<mydomain.com>/IN/inside: notify from 10.12.34.52#36460: zone is up to date</div></div><div dir="ltr" style="font-family:Helvetica, Arial, sans-serif;font-size:16px;"><br></div><div dir="ltr" style="font-family:Helvetica, Arial, sans-serif;font-size:16px;"><br></div><div dir="ltr" style="font-family:Helvetica, Arial, sans-serif;font-size:16px;"><div><div style="color:rgb(0, 0, 0);font-family:Verdana;font-size:12px;"> <br></div><div dir="ltr" style="color:rgb(0, 0, 0);font-family:Verdana;font-size:12px;">I checked an lsof of the bind process and stumbled upon thousands of these:<br><br><div><div>named 3842408 bind 1882u IPv4 959669053 0t0 UDP <myHost>:57462->172.18.117.2:domain</div><div>named 3842408 bind 1883u IPv4 959669222 0t0 UDP <myHost>:45831->172.18.12.80:domain</div><div>named 3842408 bind 1884u IPv4 959669224 0t0 UDP <myHost>:48081->172.18.12.81:domain</div><div>named 3842408 bind 1885u IPv4 959669226 0t0 UDP <myHost>:50683->172.18.48.20:domain</div><div>named 3842408 bind 1886u IPv4 959669228 0t0 UDP <myHost>:37361->172.18.48.40:domain</div><div>named 3842408 bind 1887u IPv4 959669230 0t0 UDP <myHost>:45471->172.18.48.41:domain</div><div>named 3842408 bind 1888u IPv4 959669367 0t0 UDP <myHost>:43025->172.19.2.2:domain</div><div>named 3842408 bind 1889u IPv4 959669369 0t0 UDP <myHost>:41729->172.19.2.4:domain</div><div>named 3842408 bind 1890u IPv4 959669539 0t0 UDP <myHost>:33132->172.20.1.1:domain</div><div>named 3842408 bind 1891u IPv4 959669541 0t0 UDP <myHost>:33077->172.26.22.22:domain</div><div>named 3842408 bind 1892u IPv4 959669375 0t0 UDP <myHost>:44034->172.19.96.4:domain</div><div>named 3842408 bind 1893u IPv4 959669543 0t0 UDP <myHost>:35650->172.26.84.10:domain</div><div>named 3842408 bind 1894u IPv4 959669545 0t0 UDP <myHost>:34926->172.26.110.10:domain</div><div>named 3842408 bind 1895u IPv4 959669547 0t0 UDP <myHost>:39270->172.27.78.10:domain</div><div>named 3842408 bind 1896u IPv4 959669549 0t0 UDP <myHost>:59812->172.27.78.20:domain</div><div>named 3842408 bind 1897u IPv4 959669551 0t0 UDP <myHost>:41163->172.19.48.10:domain</div></div><br></div><div dir="ltr" style="color:rgb(0, 0, 0);font-family:Verdana;font-size:12px;">Those destination IPs are configured in my configuration to a) be notified upon zone change and b) be allowed to perform zone transfers.<br>I figured out, that those IPs are old and not in use any more, so I am aware that I should remove them from my configuration completely.</div><div dir="ltr" style="color:rgb(0, 0, 0);font-family:Verdana;font-size:12px;">So connections to those IPs should just time out.<br><br>And it seems like, in bind 9.16 they timed out quite quickly, as the sockets were not kept open for too long, while in bind 9.18 it seems to be hours until they disappear again.</div><div dir="ltr" style="color:rgb(0, 0, 0);font-family:Verdana;font-size:12px;"><br></div><div dir="ltr" style="color:rgb(0, 0, 0);font-family:Verdana;font-size:12px;">Before actually removing those IPs from my configuration, I would know, if I can set a proper timeout somewhere, to prevent this from happening again.</div><div style="color:rgb(0, 0, 0);font-family:Verdana;font-size:12px;"><br></div><div dir="ltr" style="color:rgb(0, 0, 0);font-family:Verdana;font-size:12px;">The options-part of my bind config currently looks like this:<br><br><div><div>options {</div><div> check-names master ignore;</div><div> check-names slave ignore;</div><div> check-names response ignore;</div><div> dnssec-validation no;</div><div><br></div><div> directory "/var/cache/bind";</div><div> auth-nxdomain no;</div><div> zone-statistics yes;</div><div> files 4096;</div><div> allow-recursion {</div><div> localnets;</div><div> localhost;</div><div> internal;</div><div> myNetA;</div><div> myNetB;</div><div> };</div><div> check-spf ignore;</div><div> masterfile-format text;</div><div><br></div><div> listen-on port 53 { any; };</div><div><br></div><div> notify yes;</div><div> notify-source <myIp>;</div><div><br></div><div> query-source address <myIp>;</div><div>};</div></div><br></div><div dir="ltr" style="color:rgb(0, 0, 0);font-family:Verdana;font-size:12px;"><br></div><div dir="ltr" style="color:rgb(0, 0, 0);font-family:Verdana;font-size:12px;">Was there any change of a default timeout that I missed in the change logs?<br>It would be amazing, if you could help me to prevent listeners from piling up, in case notify-addresses can't be reached.</div></div><div dir="ltr" style="color:rgb(0, 0, 0);font-family:Verdana;font-size:12px;"><br></div><div dir="ltr" style="color:rgb(0, 0, 0);font-family:Verdana;font-size:12px;"><br></div><div dir="ltr" style="color:rgb(0, 0, 0);font-family:Verdana;font-size:12px;">Thanks a lot<br>Marno</div></div></div><br></div></div></div></div>-- <br>Visit <a href="https://lists.isc.org/mailman/listinfo/bind-users " rel="nofollow" target="_blank">https://lists.isc.org/mailman/listinfo/bind-users </a>to unsubscribe from this list<br><br>ISC funds the development of this software with paid support subscriptions. Contact us at <a href="https://www.isc.org/contact/ " rel="nofollow" target="_blank">https://www.isc.org/contact/ </a>for more information.<br><br><br>bind-users mailing list<br><a href="mailto:bind-users@lists.isc.org" rel="nofollow" target="_blank">bind-users@lists.isc.org</a><br><a href="https://lists.isc.org/mailman/listinfo/bind-users" rel="nofollow" target="_blank">https://lists.isc.org/mailman/listinfo/bind-users</a><br></div>
</div>
</div></body></html>