Journal errors

[Barry Finkel]

fiskeja at gmail.com wrote:

>I have seen errors like this occuring recently on my primary
>nameserver:
>
>Apr  4 07:50:38 dnsdev named[17242]: malformed transaction:
>noc.domain.db.jnl last serial 72 != transaction first serial 67
>Apr  4 07:50:38 dnsdev named[17242]: client 128.153.49.50#32771:
>updating zone 'noc.domain.edu/IN': error: journal write failed:
>unexpected error
>
>This server is running in a chrooted environment, running as user
>'named'.  We are using bind 9.2.4 (on RHEL3).  The zone files and their
>journals have permissions like this:
>
>drwxr-xr-x    2 named    named        4096 Apr  4 07:59 .
>drwxr-xr-x    3 root     root         4096 Apr  3 15:55 ..
>-rw-------    1 named    named         652 Apr  4 07:59
>xxx.xxx.128.in-addr.arpa
>-rw-r--r--    1 named    named        3850 Apr  4 07:44
>xxx.xxx.128.in-addr.arpa.jnl
>-rw-------    1 named    named        2768 Mar 30 15:54 ad.clarkson.db
>-rw-r--r--    1 named    named        1509 Mar 16 16:33 db.rootcache
>-rw-r--r--    1 named    named       57065 Apr  4 09:01 named.run
>-rw-------    1 named    named         663 Apr  4 07:59 noc.domain.db
>-rw-r--r--    1 named    named        4235 Apr  4 08:40
>noc.domain.db.jnl
>
>Google'ing the error messages hasn't helped.  Has anyone seen errors
>like this before?

I saw similar messages this morning for a forward zone that is under the
control of a MS W2003 DHCP Server and mastered on a MS W2003 DNS Server;
BIND is a slave server.  What I assume is happening is this:

For a zone transfer, the SOA record is sent at the beginning AND end
of the transfer.  The zone transfer began with SOA serial number 67.
During the zone transfer, the zone on the master server was updated.
At the end of the zone transfer, the SOA record had serial number 72,
due to the updates.  When BIND saw the mismatch in serial numbers, it
called the zone transfer transaction "malformed".  It is for this
reason that the SOA record is sent twice during the transfer.

I assume that this is what is happening; I have not looked at the BIND
code.  I also assume that if this explanation is incorrect, someone who
knows the code better than I will correct me.
----------------------------------------------------------------------
Barry S. Finkel
Computing and Information Systems Division
Argonne National Laboratory          Phone:    +1 (630) 252-7277
9700 South Cass Avenue               Facsimile:+1 (630) 252-4601
Building 222, Room D209              Internet: BSFinkel at anl.gov
Argonne, IL   60439-4828             IBMMAIL:  I1004994