Re: named DNS resolution latency

2016-04-26 Thread Stephane Bortzmeyer
On Wed, Apr 27, 2016 at 02:33:26AM -0400, digen wrote a message of 169 lines which said: > Any inputs on debugging this problem will be much appreciated. The usual stuff: 1) Is the machine hosting the resolver overloaded? top, for instance 2) is the link to the Internet overloaded? Check yo

Re: named DNS resolution latency

2016-04-26 Thread Mark Andrews
In message , digen writes: > Hi, > > Below is a sample output for reference where you can see that the amount > of time taken by named in resolving DNS records, > > http://pastebin.com/TaNfqPwL > > http://pastebin.com/3gEtutmx > > named.conf - http://pastebin.com/UBPwFKBa > > This is occurring

named DNS resolution latency

2016-04-26 Thread digen
Hi, Below is a sample output for reference where you can see that the amount of time taken by named in resolving DNS records, http://pastebin.com/TaNfqPwL http://pastebin.com/3gEtutmx named.conf - http://pastebin.com/UBPwFKBa This is occurring recently and the Linux box is 3 years old. Versio

Re: 'succesful' nsupdate of remote server not persistent across nameserver restart?

2016-04-26 Thread Warren Kumari
On Mon, Apr 25, 2016 at 2:34 PM Matthew Pounsett wrote: > > > On Monday, 25 April 2016, wrote: > >> >> >> On Mon, Apr 25, 2016, at 10:58 AM, Matthew Pounsett wrote: >> > It's not clear to me why one would want to destroy/rebuild the chroot >> every >> > time you restart the process. >> >> Well,

Re: 'succesful' nsupdate of remote server not persistent across nameserver restart?

2016-04-26 Thread jasonsu
On Tue, Apr 26, 2016, at 11:18 AM, Matthew Pounsett wrote: > Both things together are better than either one alone. Thanks for the explanation. upstream bind-chroot with systemd should be easier and better documented ___ Please visit https://lis

Re: 'succesful' nsupdate of remote server not persistent across nameserver restart?

2016-04-26 Thread Matthew Pounsett
On 25 April 2016 at 11:44, wrote: > > > > I completely gave up on chroot'd ntpd because of the endless weirdness. > Finally just moved to openntpd as (1) it had safe privsep, (2) no chroot > req'd, and (3) did the job I need. > Privsep doesn't actually fix the same problem chroot does. As I un

Re: Reload only ACL

2016-04-26 Thread Bob Harold
On Tue, Apr 26, 2016 at 10:22 AM, Ali Jawad wrote: > Hi Bob > I did have a look at > http://www.zytrax.com/books/dns/ch7/rpz.html#policy-client-ip-trigger , > and while in theory it can be used in a way similar to ACL I cant see how > it accommodates for faster changes, would you please elaborate

Re: Reload only ACL

2016-04-26 Thread Ali Jawad
Hi Bob I did have a look at http://www.zytrax.com/books/dns/ch7/rpz.html#policy-client-ip-trigger , and while in theory it can be used in a way similar to ACL I cant see how it accommodates for faster changes, would you please elaborate ? On Tue, Apr 26, 2016 at 4:46 PM, Bob Harold wrote: > > On

Re: Reload only ACL

2016-04-26 Thread Bob Harold
On Mon, Apr 25, 2016 at 5:30 PM, Carl Byington wrote: > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA512 > > On Mon, 2016-04-25 at 23:23 +0300, Ali Jawad wrote: > > based on a user tool the users "hundreds in corporate environment" get > > either public or private zone, > > Rather than the tool