BIND 8.2.1 creating lots of CPU usage for syslogd and named

[Jim Reid]

>>>>> "Michael" == Michael Voight <mvoight at cisco.com> writes:

    Michael> Someone else mentioned earlier that it appeared syslog might be
    Michael> recursively looking up the local hostname.  Syslog should not be
    Michael> recursively doing name lookups. This might be because they told syslog
    Michael> to log DNS queries. Since syslog is doing a dns query that needs to get
    Michael> logged to syslog, the cycle never ends.

This is a reasonable explanation for such a high query rate of forward
and reverse lookups of the local host name. A quick scan of the
syslogd code suggests it does a forward and reverse lookup for each
message if they arrive via syslogd's listener on port 514. This
doesn't happen if the messages get delivered through /dev/log.