DNS Problems

[Dipo Adeyinka]

Hi All,

I am having problems with two DNS Servers falling over (i.e not resolving). These are HP-UX B.10.20.U 9000/800 Servers.

The named daemon stopped running, don't know why, but restarted it on all name servers and the resolution resumed. Can anyone help with a permanent fix or suggestions for this.

Thanks

Dipo

[James R. Ferguson]

Hi:

Does /var/adm/syslog/syslog.log have any messages of interest?

...JRF...

[Andreas Voss]

Hi,

have a look at /var/adm/syslog/syslog.log or /var/tmp/named.run to see any reasons for the stopping of named (see also: man named)

Regards

[federico_3]

Try :
dmesg
or
cat /var/adm/syslog/syslog.log

to see if there are some strange messages!


Federico

[Lasse Knudsen]

Did named on both servers stop at the same time ??

Then your DNS-servers might have been target for some kind of viscious break-in attempt. Known buffer overflow issues exists in older versions of named.

You could check for 'core' files lying around. Update your named if it is to old - patches are available.

[CHRIS_ANORUO]

Hi Dipo,

After checking the syslog.log file for any tell tell signs, also check if somebody put a line in crontab file to stop the named daemons.

[Kevin Wright]

what other services do you have running on the box, telnet, finger,etc.. someone could have been trying to hack your box as the above posting said. He correctly stated that a buffer overflow could havetaken place to stop named.

[Kofi ARTHIABAH · Accepted solution]

Dipo:

You might want to try the following:
1. turn debugging on and examine the debug files for strange activity. You can do this with:

kill -USR1 `cat /var/run/named.pid`

the log files: /var/tmp/named.run
/var/tmp/named.stats would be useful.

2. You can create a script to run from the cron (say every 10 minutes) to email you if named is not running something like:

if [ "ps -ef | grep -c [n]amed" ]
then
mailx -s "named not running" someonewhocares@yourcompany.com
fi


3. install the latest version.

Good luck

[Anthony deRito]

Put named in debugging mode as follows:

level 1:
kill -USR1 `cat /var/run/named.pid`

level 2:
kill -USR1 `cat /var/run/named.pid`

level 3:
kill -USR1 `cat /var/run/named.pid`

off:
kill -USR2 `cat /var/run/named.pid`
To see the debug information for the primary make sure the resolv.conf is pointing to the primary. To see the debug information for the secondary make sure the resolv.conf is pointing to the secondary.

The debug file for named is located:
/var/tmp/named.run

Tony