Bind cpu overload

[Diego Balgera]

Hi,

I'm facing a strange problem with Bind causing Cpu overload.

The environment is:
- Hp-ux B.11.00
- Dns Bind 8.2.5-T1A

Sometimes, without any apparent reason, the Cpu usage goes to 100% where named uses someting like 97%. The named process continues to answer, but with a long delay.
And a couple of times I observed that the the Cpu usage decreased but the named stopped working, forcing me to make an "ndc restart" to workaround the problem and allow the system to resume working.
Nothing wrong appears in the syslog.

Could you help me to understand the reason and solve the problem?

Thank you in advance.
Diego.

[Mark Greene_1 · Accepted solution]

Restart named with the -d option to turn on debugging. Then monitor /var/tmp/named.run to see what system(s) are sending requests to named. It sounds like you either have a broken app or some unual DDOS attempt going on.

mark

[rick jones]

If you have it, fire-up glance and see how much of named's CPU time is user-space and how much is kernel.

While you are there, useone of the glance options to look at the syscalls being made.

If there are interesting syscalls, you might hit the named with tusc.

If there is a lot of user-space CPU time you might try getting a profile with prospect.