nslookup delay on HP-UX using Bind 4.1.3 and Bind 3.1.2 v 1.3

[Glenn L. Stewart]

Hi,

I have 4 Bind servers.
1 Master (Server X), 3 Secondaries (Server A, B, C)

Server A & B used for main resolution.
ie /etc/resolv.conf on all servers lists A then B.

During a change recently A was brought down, hence non pingable. This caused lookups on all HP-UX servers relying on A then B to (1 minute 15 per lookup).
You can try this yourself. Put a non pingable server as the first DNS server in /etc/resolv.conf

Example:

# timex nslookup hostname
*** Can't find server name for address 203.0.34.109: Timed out
Using /etc/hosts on: servername

looking up FILES
Trying DNS
Name: hostname.domain.com
Address: WW.XX.YY.ZZ

real 1:15.05
user 0.01
sys 0.02


If named was down, but the box was pingable, the delay before looking up on B instead was 0.02 seconds instead of 1 minute 15 seconds.

This delay is identical under both versions of Bind as noted in subject.

Question:
Is there a setting I can implement to reduce the length of time of this timeout?

Thanks

Glenn Stewart
Unix Administrator
Caltex Australia

[Uday_S_Ankolekar]

Hi,

Check /etc/resolv.conf file for name server, search order and Domain name.
Also look for file /etc/nsswitch.conf and see the order of host resolution files (local /etc/hosts) and then DNS..

Good luck,
-USA..

[Glenn L. Stewart]

Thanks Uday,

Not exactly the answer I am looking for.

I am aware of my domain search order and the DNS order as well as the order I search in nsswitch.conf.

To expand:

In this situation domain search order is irrelevant. nsswitch is FILES then DNS - this point is also irrelevent.

Situation is simply:

/etc/resolv.conf is:
search domain1 domain2
nameserver A
nameserver B

Case 1: DNS server A is down - delay caused
Delay of 1 min 15 sec. Finally looks at nameserver B.

Case 2: DNS server A is up, but named is not running - nearly no delay caused
Delay of 0.02 sec. Looks at nameserver B.

Please see my nslookup output as above in original post.

I am trying to determine if there is a setting the reduces delay. i.e. IF DNS server not pingable, lookup on next DNS server - do not try for 1 min 15 seconds.

In the second case a lookup will find nameserver A, realise that there is not named ready to respond to a request on nameserver A (because it isn't running in this case), then continue to ask nameserver B instead.

[Uday_S_Ankolekar]

Hi,

Can you revert the order in nsswitch file to look for DNS first and then file..?

-USA..

[Andre Da Silva Dias]

Hi!

You need to setup the timeout&retry value for the DNS queries:

add it to your .nslookuprc:
timeout=1
retry=1

or in command line:
# nslookup -timeout=1 -retry=1 hostname

timeout = 1 sec
retry = 1 retry

[Kevin Wright]

You need to upgrade you Bind version for sure. The behavior of the resolver must have changed, because the timeout value for servers in resolv.conf is 5 seconds before moving on to the next listed server.

[John Bolene]

In nslookup, you can do a set deb to turn on debugging. This will show that there are sucessive timeouts before it moves to the next server.

If you upgrade to the Bind in UX 11 (I think it is 8.1.2), there is a settable parm to tell it how long to retry before moving on.

[Sanjay_6]

Hi Glenn,

Try this,

Edit /etc/resolv.conf by adding the retry and retrans parameters.

retrans is specified in milli-seconds.

For example, to configure the system to only do two retries and to retransmit in 3 seconds, edit the file in the following manner:

domain mydomain.com
nameserver ip_of_nameserver1
nameserver ip_of_nameserver2
retry 2
retrans 3000

Hope this helps.

Regds

[Glenn L. Stewart]

Thanks Kevin,

Your solution produced the output I would like.
i.e.

# timex nslookup -timeout=0 glennpc
*** Can't find server name for address 203.0.34.109: Timed out
Using /etc/hosts on: devtest

looking up FILES
Trying DNS
Name: glennpc.sydho.ampol.com.au
Address: 10.21.20.65


real 4.45
user 0.06
sys 0.04

After not beinging able to ping DNS server (203.0.34.109), nslookup quickly queried the next DNS server in order (resolv.conf).

I would like to know if these settings are transferable to /etc/resolv.conf instead of including them with nslookup.

John,

Both versions of Bind seem to produce the same error. Of course versions 8+ are more configurable, but upgrades are occuring early next year... so I am looking for a 4 solution at present.

[Glenn L. Stewart]

Still looking for a solution to this problem.
I have used a workaround for the moment, which is to
1. Ensure database server has named running
2. Include server as first DNS in resolv.conf

Overkill to make every server a DNS server to overcome this timeout issue.

Performing
# nslookup -timeout=1 -retry=1 did work. But I still need a resolv.conf solution.

The retrans and retry options didn't help solve this issue.

Any help is much appreciated.

Glenn

[Sanjay_6]

Hi Glenn,

Give this link a try,

http://us-support2.external.hp.com/cki/bin/doc.pl/sid=4dd8d8cc0f7ac5fdff/screen=ckiDisplayDocument?docId=200000053127912

Hope this helps.

Regds

[John Bolene]

Been there, had to improvise myself.

The functionality to quickly switch to a secondary name server is only available in versions on BIND 8 and above. These versions have a setable timeout value.

What I had to do for BIND 4 was to know in advance that I was going to take down the main DNS server and to rcp new versions of /etc/resolv.conf to all my machines.

I had 2 versions of resolv.conf with the name servers being reversed in each.

BIND 4 has a 10 second timeout, a 20 second timeout and a 40 second timeout before going to the next server in the list.

I can't change the functionality of the software but I can change the config files.

But I do say it is a real bother to have to rcp all the files each time I want to play with the server.


We are on the way to getting BIND 8 and UX 11 installed everywhere.

[Steven Gillard_2]

Glenn,

Sanjay's suggestion of setting retrans and retry will not work for the nslookup command, but for applications using gethostbyname() they should be effective. Nslookup bypasses gethostbyname() and will use its own command line arguments instead (as you've seen).

The "getip" command may provide a better test as it uses gethostbyname(). Here's what I get when I set the first nameserver in /etc/resolv.conf to 1.2.3.4:

# timex getip www.hp.com
192.6.118.128

real 3.19
user 0.00
sys 0.01

# timex nslookup www.hp.com
*** Can't find server name for address 1.2.3.4: Timed out
Using /etc/hosts on: lonhp01

looking up FILES
Trying DNS
Non-authoritative answer:
Name: www.hp.com
Addresses: 192.6.118.128, 192.151.52.187, 192.151.53.86, 192.151.52.217
192.6.118.97

real 1:15.01
user 0.00
sys 0.01

As you can see, getip has correctly followed the retrans parameter in /etc/resolv.conf but nslookup has not.

Regards,
Steve

[Glenn L. Stewart]

Thanks everyone for your help.

I have nearly completed an upgrdade of all DNS servers from 4 to 8.

In the meantime though, the SAP admins have demanded that every SAP system be a DNS secondary as a work around to the original issue.

I really don't like this workaround.

Looking for the settings I can implement into the version 8 named.conf or any other solution.

Thanks

Glenn