bind9 memory leak with TreeMemTotal, and TotalUse stat seems fictional

[Alistair Bayley]

We have a resolver on Ubuntu 18.04, using the Ubuntu-packaged bind9 (1:9.11.3+dfsg-1ubuntu1.11).
The server seems to leak memory, and bind9 needs restarting every couple of weeks.
If we ignore it then the linux OOM-killer steps up and "handles" the problem for us.

We have enabled bind stats like so in /etc/bind/named.conf.options:

statistics-channels {
        inet 127.0.0.1 port 8653 allow { 127.0.0.1; };
};

and have been collecting stats into a zabbix server with the scripts from
https://github.com/Pesticles/Zabbix-Bind9-Statistics-Collection.

I can emit arbitrary stats on demand like so:

# wget http://localhost:8653 -qO - | xmllint --format - | grep -E 'TreeMemTotal|TotalUse'
        <counter name="TreeMemTotal">234006180</counter>
        <counter name="TreeMemTotal">287792</counter>
      <TotalUse>16510250005</TotalUse>

For example, just today, TotalUse has increased from about 4GB at 07:00 to about 15GB at 16:00.
Also today, TreeMemTotal has increased from about 70MB at 07:00 to about 220MB at 16:00.

There are 2 things that I would like more insight into:

(1) why is TreeMemTotal (cache tree memory total) constantly increasing?
    We restart bind9 when it gets over 1GB. This memory use is not reflected
    in the actual memory use on the machine, as reported by top/free.

(2) what is TotalUse measuring? I assumed bytes, but this measure gets
    over 100GB on a machine with only 2GB RAM, and 10G disk on /var
    (only 2.3G used), so I wonder if it is measuring something else.
    It is in the /statistics/memory/summary/ section of the XML emitted
    on port 8653, so it certainly looks like memory bytes e.g.
...
    <summary>
      <TotalUse>16969284048</TotalUse>
      <InUse>170518137</InUse>
      <BlockSize>203685888</BlockSize>
      <ContextSize>7959160</ContextSize>
      <Lost>0</Lost>
    </summary>
  </memory>
</statistics>


Thanks,
Alistair

This email and attachments: are confidential; may be protected by privilege and copyright; if received in error may not be used, copied, or kept; are not guaranteed to be virus-free; may not express the views of Kordia(R); do not designate an information system; and do not give rise to any liability for Kordia(R).
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.isc.org/pipermail/bind-users/attachments/20200220/b43c56d8/attachment.htm>