0

I'm currently in the process of migrating my BIND master host to a new physical machine and IP. I've installed on the new master and tested out updating a zone file and seeing the slaves take the new serial. I've also updated /etc/resolv.conf in my production environment to ensure no hosts are hitting the old master...however, checking the query logs I still see lots of queries hitting the old BIND master (mostly during puppet runs). Trying to play whack-a-mole with restarting services dependent on querying will take too long...I have a few questions:

  1. Anyone familiar with this problem with nameserver caching? If so, how did you resolve it?
  2. Would shutting off named on the old master resolve this problem?
  3. In the meantime, would having admins update the serial and reload named in two places be bad for the slaves?
1
  • Do a TCPDUMP on the old master. Figure out which systems are attempting to connect to the old server. Then fix them. You could also just stop the old bind server and see what breaks, if you can afford a potential outage/slowness.
    – Zoredache
    Apr 12, 2013 at 0:39

1 Answer 1

0

1) The previous suggestion of tcpdump seems good - would at least identify sources.

2) This is unlikely to fully resolve the problem, it will cause systems to timeout when hitting the first nameserver which may cause other problems. I would avoid this if you can as it will also make it harder to fully identify the underlying problem.

3) The slaves should only be pulling from one source so updating in two locations should not impact them in a negative way.

1
  • I have query logging enabled to I can search against the logs to find the highest offenders, and based on what they're querying for I can usually correlate that to what service it corresponds to. Grepping against the host query instead of the source IP, it looks like a large majority of the queries are coming from the puppet agent itself when it initiates a run. I was hoping to avoid playing whack-a-mole, and also having to restart all of my puppet agents, but it looks like this is my only option right now...
    – 580farm
    Apr 12, 2013 at 19:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .