Bind 9 on RH9 dying

[Thomas Schulz]

In article <cl8i12$1ahs$1 at sf1.isc.org>, Mueller, Rex <rmueller at esu3.org> wrote:
>David,=20
>
>Agreed, we'd tried to start the process since it was dead. Only
>rebooting brings it back.=20

If by 'dead' you mean that the process no longer exists, you should be
able to just start it again.
If by 'dead' you mean that the process does exist but does not do anything,
you have to kill it.  If it does not respond to HUP, try TERM.  If it does
not respond to TERM, try KILL.  kill KILL should be able to kill anything.
What version of Bind 9 are you running?  If you are running anything less
than Bind 9.2.4, you are probably hitting a bug.  There are denial of
service exploits that can affect older versions.


>I've looked at the /var/log/messages and can't find any indication of
>the process going south other then getting a bunch of "lame server" and
>"NXRESET"  messages it appears to be running.=20
>
>
>Oct 17 04:02:22 class named[1764]: client xxx.xxx.xxx.xxx#2808: update
>'xxx.net/IN'
> denied
>Oct 17 04:02:23 class named[1764]: lame server resolving
>'dropyourdet.com' (in '
>dropyourdet.com'?): 222.134.66.53#53
>Oct 17 04:02:23 class named[1764]: lame server resolving
>'dropyourdet.com' (in '
>dropyourdet.com'?): 211.158.35.246#53
>Oct 17 04:02:27 class named[1764]: client xxx.xxx.xxx.xxx#4852: updating
>zone 'xxx.net/IN': update failed: 'RRset exists (value dependent)'
>prerequisite not satisfied (NXRRSET)
>Oct 17 04:02:27 class named[1764]: client xxx.xxx.xxx.xxx#4855: update
>'xxx.net/I
>N' denied
>Oct 17 04:02:29 class cups: cupsd shutdown succeeded
>Oct 17 04:02:29 class modprobe: modprobe: Can't locate module
>char-major-188
>Oct 17 04:02:29 class last message repeated 15 times
>Oct 17 04:02:29 class cups: cupsd startup succeeded
>
>
>-----Original Message-----
>From: bind-users-bounce at isc.org [mailto:bind-users-bounce at isc.org] On
>Behalf Of David Botham
>Sent: Thursday, October 21, 2004 9:20 AM
>To: bind-users at isc.org
>Subject: Re: Bind 9 on RH9 dying
>
>bind-users-bounce at isc.org wrote on 10/21/2004 09:56:19 AM:
>> I am curious about what to look at. We've been running BIND 9 for=20
>> about a year without a hitch, within the past couple of weeks the=20
>> daemon has been dying for no apparent reason, we attempt to HUP the=20
>> process and
>
>Sending a signal (HUP, TERM, KILL, or otherwise) to a process that is
>not running is pointless.  In other words, the process has to be running
>to deal with the signal.  It is sort of like talking to someone who is
>not there.
>
>What do your logs say?
>
>Dave...
>
>[clip...]
-- 
Tom Schulz
schulz at adi.com