bind timeouts

[Sven Willenberger]

On Mon, 2004-05-17 at 16:50 +1000, Dennis Kristensen wrote:
> On Tue, 2004-05-11 at 19:36, Cyrille Lefevre wrote:
> > On Mon, May 10, 2004 at 08:21:15PM -0700, David Wolfskill wrote:
> > > >From: "Cyrille Lefevre" <clefevre-lists at 9online.fr>
> > 
> > CC -current
> > 
> > > >for some times, I have some troubles to send e-mails, they
> > > >are returned w/ a host unknown error message (the relay)...
> > > >I spent a whole day to track down the problem w/o success.
> > > >...
> > > >however, it seems to be located around bind, but I don't know
> > > >if it's the client side or the server side which is broken,
> > > >maybe the TCP stack !
> > > 
> > > >I'm running -current last updated around 18 April 2004.
> > > 
> > > I have been tracking both -STABLE and -CURRENT daily for quite a while;
> > > I don't recall seeing the symptoms you report.
> > 
> > someone (Dennis Kristensen) reports me to have similar problems but
> > forget to CC -current :(
> 
> After observing this for some days now (with no progress towards a
> solution), i think this might be a problem with the kernel rather than
> BIND. I have a 5.2.1-p5 system that shows the same symptons. It is
> lightly loaded and the above mentioned symptons start appearing after
> 1-3 days of uptime. A restart of BIND does not change anything, but af
> reboot of the system gives me another few days of correct operation.
> 
> I hope the above can give someone more hints to what might be going on.
> I also hope to get some pointers to resource counters i can check to try
> an identify if something is leaking.
> 
> The mail system is standard qmail, qmail-scanner with clamav and
> spamassassin and vpopmail - all from ports.
> 
> Thanks for any hints or information in advance,
> Dennis Kristensen

We had issues with qmail and bind playing nice together, with frequent
"CNAME_lookup_failed_temporarily" entries in the logfiles. Having the
mailserver use a nameserver that is running tinydns/dnscache solved the
problem (not really a big surprise knowing djb's disdain for the isc
product). Why you would start having this issue I don't know, but you
may want to try the tinydns/dnscache alternative.

Sven