Bug 556366
| Summary: | bind repeatedly requests DNSKEY records after getting responses with unknown keys | |||
|---|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Kieran Clancy <clancy.kieran+redhat> | |
| Component: | bind | Assignee: | Adam Tkac <atkac> | |
| Status: | CLOSED ERRATA | QA Contact: | Fedora Extras Quality Assurance <extras-qa> | |
| Severity: | medium | Docs Contact: | ||
| Priority: | low | |||
| Version: | 12 | CC: | al.dunsmuir, amessina, antonio, atkac, eddie, jl-icase, ovasik, pwouters | |
| Target Milestone: | --- | |||
| Target Release: | --- | |||
| Hardware: | All | |||
| OS: | Linux | |||
| Whiteboard: | ||||
| Fixed In Version: | bind-9.6.2-2.P1.fc12 | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | ||
| Clone Of: | ||||
| : | 572848 (view as bug list) | Environment: | ||
| Last Closed: | 2010-03-27 00:55:16 UTC | Type: | --- | |
| Regression: | --- | Mount Type: | --- | |
| Documentation: | --- | CRM: | ||
| Verified Versions: | Category: | --- | ||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | ||
| Cloudforms Team: | --- | Target Upstream Version: | ||
| Embargoed: | ||||
| Bug Depends On: | ||||
| Bug Blocks: | 572848, 572850 | |||
|
Description
Kieran Clancy
2010-01-18 05:03:26 UTC
This issue is addressed in 9.6.2-P1 upstream release. bind-9.6.2-2.P1.fc11 has been submitted as an update for Fedora 11. http://admin.fedoraproject.org/updates/bind-9.6.2-2.P1.fc11 bind-9.6.2-2.P1.fc12 has been submitted as an update for Fedora 12. http://admin.fedoraproject.org/updates/bind-9.6.2-2.P1.fc12 bind-9.6.2-2.P1.fc12 has been pushed to the Fedora 12 testing repository. If problems still persist, please make note of it in this bug report. If you want to test the update, you can install it with su -c 'yum --enablerepo=updates-testing update bind'. You can provide feedback for this update here: http://admin.fedoraproject.org/updates/bind-9.6.2-2.P1.fc12 bind-9.6.2-2.P1.fc11 has been pushed to the Fedora 11 testing repository. If problems still persist, please make note of it in this bug report. If you want to test the update, you can install it with su -c 'yum --enablerepo=updates-testing update bind'. You can provide feedback for this update here: http://admin.fedoraproject.org/updates/bind-9.6.2-2.P1.fc11 *** Bug 575604 has been marked as a duplicate of this bug. *** bind-9.6.2-2.P1.fc11 has been pushed to the Fedora 11 stable repository. If problems still persist, please make note of it in this bug report. bind-9.6.2-2.P1.fc12 has been pushed to the Fedora 12 stable repository. If problems still persist, please make note of it in this bug report. The news is both bad and good. Bad first: bind-9.6.2-2.P1.fc12 doesn't fix related bug #575604 and in fact makes it worse because DNS stops answering queries -- it only generates numerous syslog messages. However, reconfiguring named to *not* use forwarders restores normal operation. Suggestion: bind should be able to function even if forwarders don't handle DNSSEC and/or DLV properly. Shouldn't this bug be reopened then now? Maybe this bug should be reopened, although its symptoms changed. Even without forwarders, the latest bind produces thousands of messages daily, about *both* successes and failures, e.g. success resolving... after reducing the advertised EDNS UDP packet size to 512 octets lame server resolving... connection refused resolving... validating @x... ... no valid signature broken trust chain resolving... unexpected RCODE (REFUSED) resolving... unexpected RCODE (SERVFAIL) resolving... must-be-secure resolving... client... RFC 1918 response from Internet for... Before I removed my forwarders, virtually all messages said "broken trust chain resolving..." and DNS queries went unresolved. Without forwarders (i.e. working from named.ca) DNSSEC+DLV works but logs storms of INFO messages every few seconds. This level of detail is more appropriate for a debugging version of bind than for a production package. Named w/DNSSEC+DLV generates >100,000 messages/week = about 3/4 of all syslog messages on my server -- that's way too much for comfort. I get no benefit from so much raw information. Named should work competently, with *rare* problems coalesced & reported, or DNSSEC+DLV isn't ready for normal use. Okay,
I also encountered this issue in the past and solved it my own way.
I configured the logging channels to something like this and the problem of cluttering up the syslog was gone:
logging {
channel default_syslog {
syslog daemon;
severity info;
};
channel standard_syslog {
syslog daemon;
severity dynamic;
};
channel named_logfile {
file "/var/log/named.log";
print-time yes;
print-severity yes;
print-category yes;
severity dynamic;
};
category update { standard_syslog; };
category lame-servers { named_logfile; };
category query-errors { named_logfile; };
category edns-disabled { named_logfile; };
};
|