Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This may also apply to any other applications similar to BIND. Currently my home server's Linux install is located on a USB flash drive (for fun), which is fairly slow compared to a SATA drive for example.

How exactly does BIND work when it looks up a query via a forwarder? Is the result cached on the hard drive (or USB flash drive in my case)? Would this cause the query to be slower?

I have noticed that when using the forwarders directly, the query is sometimes significantly faster. I have a SATA hard drive (for storage) so maybe I could use this drive to increase the speed, if the local drive is at all involved in the equation.

On the other hand, I may be imagining that the flash drive makes queries slower - I'm not entirely sure how to prove/disprove this; if anyone knows of a practical method, please advise.

share|improve this question
up vote 1 down vote accepted

Generally if you wish to know what a process/user/file is doing without having to run lsof against it 24/7 you use auditctl.

Assuming you have a recent-ish kernel audit control should be a simple operation. (This is in debianfu, if your running redhat translate as appropriate)

# apt-get install auditd

Make sure that its running (/etc/init.d/auditd status).

auditctl -a entry,always -F arch=b64 -S open -F pid=<process id>

Replace b64 with b32 if your running 32-bit arch, open can be replaced by any system call or the word 'all'

For more read the auditctl manpage.

share|improve this answer
Nice, thanks! I'm sure this will be useful for other stuff too. – nbolton Feb 23 '10 at 10:20

Reading through this link here there's a statement that reads, in part, "Clearing the cache is really a side effect of killing the name server, since BIND name servers only store cached data in memory." That would imply that your caching is coming off memory.

How much memory does the machine have? Any other loads on it (like top showing a high load value or something eating the processor?)

share|improve this answer
Plenty of RAM. Perhaps the speed issue lies elsewhere. – nbolton Feb 23 '10 at 10:19

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.