named consuming 99%+ CPU on both NS1 ans NS2 simultaneously

[Mark_Andrews at isc.org]

 It sounds like a DNS storm.  When TSIG support was added RD stopped
 being cleared by mistake.  This was fixed in BIND 8.2.2.

 DNS storms are the result of servers being delegated zones for
 which they are not configured then having a query come in.  They
 were reasonable common in the early days.

 For a while BIND used to SERVFAIL when it detected that it was
 self lame.  Now it forwards the query again.

 Mark

 692.   [bug]           RD was not being cleared by ns_forw().  this could
			cause DNS storms between lame servers.


> I am experiencing a problem that I dont have an answer for. I am
> seeing CPU spikes reaching 99%+ on both the primary and secondary
> nameservers simultaneously. The servers spike at the same time and
> return to normal (1% to 7%) at the same time. If I delete all zone
> files on NS2 and restart it, it will create copies of all zone files
> without any problems. If I kill named on NS2, NS1 runs like a champ
> with no CPU spikes. The interval between spikes is irregular.
> 
> I was originally running DNS services on Solaris 2.6...then 7. We
> recently replaced the Sun Sparcs with 2 Intel based servers running
> Red Hat 6. I simply transfered the named.conf and db.* files to the
> new nameservers and brought them online. All seemed to be well...until
> I noticed slow response times when browsing....dug alittle deeper and
> found that named was consuming all my resources :( These particular
> servers are authorative for about 20 domains.
> 
> The old servers were Sparc based with 500Mhz processors w/ 512 megs of
> memory...ran like a champ!! The New servers are Dell Poweredges with
> PIII 500s and 256 megs of memory. They shipped with Red Hat.
> 
> Anyone heard of any reasons why named would cause such spikes?
> 
> Stephen J naidyhorski
> naidyhorski at home.com
> 
--
Mark Andrews, Internet Software Consortium
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: marka at isc.org