gmane.network.dns.bind.user

Operation cancelled Error

Ben — 2012-05-23T18:14:02

Hi,

I am doing load testing for bind as caching dns server.Fro that i 
configure one machine as client and one as server.I setup bind as 
caching dns server and set recursive-clients 30000.

While doing load test from client machine via resperf, i got many errors 
in named.run file which shows,I checked that time there is no cpu high 
usage / memory high usage on server and clients.Why server is not 
permitted operation.

23-May-2012 23:30:12.085 error (operation canceled) resolving 
'www.thethreadexchange.com/AAAA/IN': 192.33.14.30#53
23-May-2012 23:30:12.085 error (operation canceled) resolving 
'c2.nstld.net/A/IN': 192.42.93.31#53
23-May-2012 23:30:12.085 error (operation canceled) resolving 
'nothirst.com/A/IN': 192.54.112.30#53
23-May-2012 23:30:12.085 error (operation canceled) resolving 
'172.153.42.186.in-addr.arpa/PTR/IN': 199.212.0.53#53
23-May-2012 23:30:12.085 error (operation canceled) resolving 
'xxy.com/MX/IN': 192.12.94.30#53
23-May-2012 23:30:12.086 error (operation canceled) resolving 
'19

Re: Bind configuration and log error

Mike Hoskins — 2012-05-23T17:58:11

-----Original Message-----
From: Amira Othman <a.othman< at >cairosource.com>
Date: Wednesday, May 23, 2012 3:56 AM
To: <bind-users< at >lists.isc.org>
Subject: Bind configuration and log error

i selfishly focused too much on the log message and ignored your question
at the end...

if you can't dig or ping the server (do you really need to be able to ping
it?  many smart admins will filter most icmp only allowing type 3, code 4
to avoid breaking pmtud), first check intermediate firewalls as Matus
suggested.  on your test host fire up a "ping <nameserver>" and on your
name server run "tcpdump -i <whatever> -vvv host <test_host>" (<whatever>
should be the interface with the ip address hosting bind) and ensure you
can see the icmp traffic.  do the same for dig.  if you don't see the
traffic at all, it's getting dropped upstream.

that said, you might also share your named.conf and more details...  it's
possible you also need to ensure your listen-on and things like
match-destinations within views are properly configure

Re: Bind configuration and log error

Mike Hoskins — 2012-05-23T16:38:52

-----Original Message-----
From: Matus UHLAR - fantomas <uhlar< at >fantomas.sk>
Date: Wednesday, May 23, 2012 4:04 AM
To: <bind-users< at >lists.isc.org>
Subject: Re: Bind configuration and log error

i suppose it could be peering or some other internet anomaly as well,
anything affecting connectivity?

i'm in the middle of migrating several large sites from tiny to bind and
had to work through errors in logs with firewall admins...  allowing
general 'any 53 udp/tcp' access and adjusting permissible udp payload size
for edns are the two main examples which are well understood.  that said,
even after the firewall admins opened up access to any on 53 udp/tcp from
the name servers i still see these in my logs...but only occasionally and
typicaly for hosts that are "far away" geographically.

after having the firewall configuration shown to me in plain text, i
mostly wrote it off...how often do others see this?

thanks!

_______________________________________________
Please visit https://lists.isc.org/mailman/listinfo

Re: Bind configuration and log error

Matus UHLAR - fantomas — 2012-05-23T11:04:52

your server has apparently problems with internet conectivity. Is it 
behind firewall?

Bind configuration and log error

Amira Othman — 2012-05-23T10:56:37

Hi all

I have in my messages log file many lines as follows but with different
domains unreachable what does this mean:

named[15490]: network unreachable resolving 'platinum.cs.umanitoba.ca/A/IN'

also I can't dig or nslookup or ping my DNS server remotely what should I do
to enable that?

Regards

_______________________________________________
Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list

bind-users mailing list
bind-users< at >lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users

Re: Bind9.9.1 Dependences

Dennis Clarke — 2012-05-22T18:23:17


Here is what I see :

root< at >testy:~# rndc -s 127.0.0.1 -p 953 -k /usr/local/mm/etc/rndc.key status
version: 9.8.3
CPUs found: 1
worker threads: 1
number of zones: 19
debug level: 0
xfers running: 0
xfers deferred: 0
soa queries in progress: 0
query logging is OFF
recursive clients: 0/0/1000
tcp clients: 0/100
server is up and running

root< at >testy:~# readelf -d /usr/local/mm/sbin/named

Dynamic section at offset 0x9d380 contains 34 entries:
  Tag        Type                         Name/Value
 0x0000000000000001 (NEEDED)             Shared library: [liblwres.so.80]
 0x0000000000000001 (NEEDED)             Shared library: [libdns.so.81]
 0x0000000000000001 (NEEDED)             Shared library: [libbind9.so.80]
 0x0000000000000001 (NEEDED)             Shared library: [libisccfg.so.82]
 0x0000000000000001 (NEEDED)             Shared library: [libcrypto.so.0.9.8]
 0x0000000000000001 (NEEDED)             Shared library: [libisccc.so.80]
 0x0000000000000001 (NEEDED)             Shared library: [libisc.so.83]
 0x0000

Re: Bind9.9.1 Dependences

Evan Hunt — 2012-05-22T17:18:42


"configure" will complain if you're missing anything critical.

BIND 9 has relatively few dependencies other than a C compiler and
POSIX-compliant system libraries.  You need openssl if you want to use
crypto; libxml2 if you want XML-based statistics; perl if you want to
run the tests, and some of the tests specifically want Net::DNS.  I
can't think of anything else, offhand.

(I'm assuming you mean BIND 9.  BIND 10 has a longer list.)

RE: Bind9.9.1 Dependences

Spain, Dr. Jeffry A. — 2012-05-22T16:37:33

I have successfully built Bind 9.9.1 on Ubuntu 12.04 LTS (Precise Pangolin). Since Ubuntu comes with a previous version of the Bind 9 utilities installed, I uninstall the following packages:
apt-get purge bind9-host dnsutils libbind9-80 libdns81 libisc83 libisccc80 libisccfg82 liblwres80

To be able to build bind9, I install the following tools for building software packages:
apt-get install build-essential autoconf libtool pkg-config

Bind9 has a dependency on OpenSSL:
apt-get install libssl-dev

After that you should be able to download Bind 9.9.1, configure, make, and make install. See bind-9.9.1/README for info on options to configure.

Hopefully this provides some general guidance regardless of distribution. I have a script and some ancillary files that I can send you if you are in fact using Ubuntu 12.04 LTS.

Jeffry A. Spain
Network Administrator
Cincinnati Country Day School

_______________________________________________
Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe

RE: Bind9.9.1 Dependences

Dennis Clarke — 2012-05-22T16:27:25



Because this is linux/UNIX 101 we should go offlist.

Drop me an email and I will go get a rev/lib full list on my prod servers.

Dennis

RE: Bind9.9.1 Dependences

Manson, John — 2012-05-22T16:19:10

Yes
It would help if you could add the version of each listed below.
What are the 'few others"?
Thanks


-----Original Message-----
From: Dennis Clarke [mailto:dclarke< at >blastwave.org]
Sent: Tuesday, May 22, 2012 12:14 PM
To: Manson, John
Cc: 'bind-users< at >lists.isc.org'
Subject: Re: Bind9.9.1 Dependences




I am not sure of the question but here is my best response:

   assume you need openssl, libiconv, gnu gettext, libxml2

 you may also want libidn and a few others.

Does this help?

Dennis


--
--
http://pgp.mit.edu:11371/pks/lookup?op=vindex&search=0x1D936C72FA35B44B
+-------------------------+-----------------------------------+
| Dennis Clarke           | Solaris and Linux and Open Source |
| dclarke< at >blastwave.org   | Respect for open standards.       |
+-------------------------+-----------------------------------+

_______________________________________________
Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list

bind-users mailing list
bind-users< at >lists.isc.or

Re: Bind9.9.1 Dependences

Dennis Clarke — 2012-05-22T16:14:08



I am not sure of the question but here is my best response:

   assume you need openssl, libiconv, gnu gettext, libxml2

 you may also want libidn and a few others.

Does this help?

Dennis

Bind9.9.1 Dependences

Manson, John — 2012-05-22T15:53:07

How can I find out which Unix files/libraries bind requires before I do the compile?
Thanks


John Manson
CAO/HIR/NI Data-Communications | U.S. House of Representatives | Washington, DC 20515
Desk: 202-226-4244 | Team: 202-225-5552 | john.manson< at >mail.house.gov




_______________________________________________
Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list

bind-users mailing list
bind-users< at >lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users

Re: Checking for zone expiration?

Matus UHLAR - fantomas — 2012-05-22T09:38:03

On 21.05.12 22:27, Chris Thompson wrote:

Isn't there anything other that will trigger transfer attempt, or is it 
useless in such case?

Re: Checking for zone expiration?

Jan-Piet Mens — 2012-05-22T09:09:43

Warren,


Cool stuff and very useful. I took it for a tiny spin, and here are my
EUR 0.02 :)

1. Doesn't seem to grok all RRtypes in  slave zones, due probably to
   missing functionality of dnspython; the following diagnostic on a
   zone containing a KEY RR:

   Unable to parse /var/named/jpmens.org: /var/named/jpmens.org:107:
   generic rdata does not start with \#

2. The program should perhaps ignore non-zone files (e.g. *.key, *.jnl,
   *.jbk), although that can be influenced with `-f'... 
   
   In particular, directories ought to either be skipped or descended
   into.

3. Parsing of large zone files takes quite a while... (dnspython)

4. I spent a bit of time debugging becausse a slave zone wouldn't parse:
   dnspython raised a dns.zone.NoSOA exception. Only *after* debugging,
   did I read the FM to discover that zone file-names are origin names;
   maybe add this a bit more prominently to the top of the fine manual?  :)

Regards,

        -JP
_______________________________________________
Please

Re: Checking for zone expiration?

Mark Andrews — 2012-05-22T04:42:31

While not a help at the moment, BIND 9.10 has "rndc zonestatus" which
will report when the zone is due expire.

Mark

Re: Checking for zone expiration?

Alan Batie — 2012-05-22T02:41:59

Thanks!  I'll try the various monitoring options...  I don't have
"try-tcp-refresh no", so I'm afraid that doesn't explain it either...

_______________________________________________
Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list

bind-users mailing list
bind-users< at >lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users

Re: Checking for zone expiration?

Mark Pettit — 2012-05-21T22:53:15


I have not tried this, so pardon me if I misunderstand, but getting the zones and serials from each zone on a slave does not help you determine if a zone is about to expire.

If a zone doesn't change for two years, the serial will never change.  But the refresh timer will expire over and over, and each time the zone must be refreshed.  The only guaranteed way I know of to determine whether or not it's been refreshed is to check the mtime on the zone file on the slave.

_______________________________________________
Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list

bind-users mailing list
bind-users< at >lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users

Re: Checking for zone expiration?

Mike Hoskins — 2012-05-21T23:11:51

-----Original Message-----
From: Mark Pettit <pettit< at >yahoo-inc.com>
Date: Monday, May 21, 2012 3:53 PM
To: Microsoft Office User <michoski< at >cisco.com>
Cc: Barry Margolin <barmar< at >alum.mit.edu>,
"comp-protocols-dns-bind< at >isc.org" <comp-protocols-dns-bind< at >isc.org>
Subject: Re: Checking for zone expiration?

*sigh* thanks for the stupidity catch, i jumped the gun -- just enabled
statistics-channels and trying to find more uses for it!  ;-)

maybe this could be a feature in a future bind release (per-zone
expiration timer in statistics output).  we generally always work to move
anything we can from local/shell-based checks to network queries.

_______________________________________________
Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list

bind-users mailing list
bind-users< at >lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users

BIND 9.6-ESV-R7 is now available

Michael McNally — 2012-05-21T22:14:19

Introduction

   BIND 9.6-ESV-R7 is the most recent release of BIND 9.6-ESV.

   BIND 9.6-ESV is an Extended Support Version of BIND 9.

   This document summarizes changes from BIND 9.6-ESV-R6 to BIND
   9.6-ESV-R7.  Please see the CHANGES file in the source code
   release for a complete list of all changes.

Download

   The latest versions of BIND 9 software can always be found on
   our web site at http://www.isc.org/downloads/all. There you will
   find additional information about each release, source code, and
   pre-compiled versions for Microsoft Windows operating systems.

Support

   Product support information is available on http://www.isc.org/support
   for paid support options.  Free support is provided by our user
   community via a mailing list.  Information on all public email
   lists is available at https://lists.isc.org/mailman/listinfo.

Security Fixes

*  Windows binary packages distributed by ISC are now built and linked
   against OpenSSL 1.0.0i

New Features

*  None

Feature Chang

BIND 9.7.6 is now available

Michael McNally — 2012-05-21T22:14:19

Introduction

   BIND 9.7.6 is the latest production release of BIND 9.7.

   This document summarizes changes from BIND 9.7.5 to BIND 9.7.6.
   Please see the CHANGES file in the source code release for a
   complete list of all changes.

Download

   The latest versions of BIND 9 software can always be found on
   our web site at http://www.isc.org/downloads/all. There you will
   find additional information about each release, source code, and
   pre-compiled versions for Microsoft Windows operating systems.

Support

   Product support information is available on http://www.isc.org/support
   for paid support options.  Free support is provided by our user
   community via a mailing list.  Information on all public email
   lists is available at https://lists.isc.org/mailman/listinfo.

Security Fixes

*  Windows binary packages distributed by ISC are now built and linked
   against OpenSSL 1.0.0i

New Features

*  None

Feature Changes

*  BIND now recognizes the TLSA resource record type, created to
   s

BIND 9.8.3 is now available

Michael McNally — 2012-05-21T22:14:19

Introduction

   BIND 9.8.3 is the latest production release of BIND 9.8.

   This document summarizes changes from BIND 9.8.2 to BIND 9.8.3.

   Please see the CHANGES file in the source code release for a
   complete list of all changes.

Download

   The latest versions of BIND 9 software can always be found on
   our web site at http://www.isc.org/downloads/all. There you will
   find additional information about each release, source code, and
   pre-compiled versions for Microsoft Windows operating systems.

Support

   Product support information is available at http://www.isc.org/support
   for paid support options. Free support is provided by our user
   community via a mailing list.  Information on all public email
   lists is available at https://lists.isc.org/mailman/listinfo.

Security Fixes

*  Windows binary packages distributed by ISC are now built and linked
   against OpenSSL 1.0.0i

New Features

*  None

Feature Changes

*  BIND now recognizes the TLSA resource record type, created to
   s