At 09:40 PM 9/9/2014, you wrote:
>On 9/9/2014 05:05, lcon...@go2france.com wrote:
>> freebsd 10.0, bind-9.10.0-p2
>>
>> logging the rss field for named process:
>>
>>
>> less /var/tmp/bind_rss_history.txt
>>
>> This never happened with earlier BIND9, and our mx1 uses this recursive
>> BIND machine for all domain/ptr lookups
>>
>> I've never seen any bind take over 1GB of RAM.
>>
>> max-cache-size isn't the solution, only a band-aid
>>
>> the sawtooth above is from restarting named.
>>
>> named has halted twice in the past couple weeks, we suspected some kind
>> of attack, the only trace we had was in syslog with something like "swap
>> space failed, named halted", but with a dedicated DNS box and 3 GB,
>> there should never be any swapping. I set a watcher for "swap used >
>> 1%". Got an alert, I saw the named rss to be 1.9GB. restarted bind and
>> wrote the rss named logging script.
>>
>> Len
>>
>
>This is a bit worrying for me, as I am running this version on my
>master. Do you mind sharing the rss watcher/logging script?
cat /usr/local/bin/bind_rss_history.sh
#!/bin/sh
touch /var/tmp/bind_rss_history.txt
RSS=`ps auxw | awk '/^bind.*named/{print $6}'`
NOW=`date "+%Y-%m-%d %H:%M:%S"`
echo "$NOW $RSS" | awk '{printf "%10s%10s%11s\n",$1,$2,$3}' >>
/var/tmp/bind_rss_history.txt
exit 0
_______________________________________________
Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe
from this list
bind-users mailing list
bind-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users
