Home / server / Questions / 611608
In Process
dorian
Asked: 2014-07-11 06:27:38 +0800 CST

Why is BIND 9.8.4 using a lot more CPU time than BIND 9.7.0?

  • 772

I recently migrated a small DNS setup from one machine to another. The only thing that changed was the version of bind in use:

root@old_box:~ $ named -V
BIND 9.7.0-P1 built with '--prefix=/usr' '--mandir=/usr/share/man' '--infodir=/usr/share/info' '--sysconfdir=/etc/bind' '--localstatedir=/var' '--enable-threads' '--enable-largefile' '--with-libtool' '--enable-shared' '--enable-static' '--with-openssl=/usr' '--with-gssapi=/usr' '--with-gnu-ld' '--with-dlz-postgres=no' '--with-dlz-mysql=no' '--with-dlz-bdb=yes' '--with-dlz-filesystem=yes' '--with-dlz-ldap=yes' '--with-dlz-stub=yes' '--with-geoip=/usr' '--enable-ipv6' 'CFLAGS=-fno-strict-aliasing -DDIG_SIGCHASE -O2' 'LDFLAGS=-Wl,-Bsymbolic-functions' 'CPPFLAGS='

versus

root@new_box:/etc# named -V
BIND 9.8.4-rpz2+rl005.12-P1 built with '--prefix=/usr' '--mandir=/usr/share/man' '--infodir=/usr/share/info' '--sysconfdir=/etc/bind' '--localstatedir=/var' '--enable-threads' '--enable-largefile' '--with-libtool' '--enable-shared' '--enable-static' '--with-openssl=/usr' '--with-gssapi=/usr' '--with-gnu-ld' '--with-geoip=/usr' '--enable-ipv6' 'CFLAGS=-fno-strict-aliasing -DDIG_SIGCHASE -O2'
using OpenSSL version: OpenSSL 1.0.1e 11 Feb 2013
using libxml2 version: 2.8.0

CPU usage on the old box was between 0% and 5% while now it's more around 10%. These are very unscientific measurements, I know, but I wondered whether this was a common observation.

The behavior is as far as I can see not related to the known bug where BIND cannot create a managed-keys.bind file, as the symptom there would be close to 100% CPU usage.

Thanks for any pointers.

[e]: Michael Hampton made a valid comment about the machines themselves. They're both HP Micro Servers with an Athlon II Neo dual core processor at 800MHz. Both are rated at about 2600 bogomips according to /proc/cpuinfo, thus I think CPU percentage should be comparable between the two.

bind

1 Answers

  1. I had this same problem, but instead of a 5% increase in BIND's CPU usage, it was about 10x as much - from about 6% to 19% CPU (on a single core) to around 150% to 200% CPU.

    And just as Håkan Lindqvist posted, it was because I had (intentionally, not through some kind of backup procedure) turned on DNSSEC. Because it was recommended that I do so for some unrelated issues.

    If your DNS server is using a lot of CPU, you should consider turning off these values:

    dnssec-enable yes;
dnssec-validation auto;
dnssec-lookaside . trust-anchor dlv.isc.org.;
    • 0