This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

DNS Proxy died - third time !!!

Hello,

just another time the DNS Proxy died. The ASL is brand new installed due to this. It run about one week.
I recognized cause surfing through transparent proxy didn´t work anymore.

Here is the DNS Logfile
Code:

  2004:05:21-18:05:01 (none) named[24455]: done dumping nameserver stats
2004:05:21-18:10:00 (none) named[24455]: named shutting down
2004:05:21-18:10:00 (none) named[24455]: USAGE 1085155800 1085069401 CPU=2.32u/0.56s CHILDCPU=0u/0s
2004:05:21-18:10:00 (none) named[24455]: NSTATS 1085155800 1085069401 A=3451 PTR=1 MX=85 TXT=2
2004:05:21-18:10:00 (none) named[24455]: XSTATS 1085155800 1085069401 RR=1960 RNXD=274 RFwdR=63 RDupR=16 RFail=0 RFErr=0 RErr=0 RAXFR=0 RLame=0 ROpts=0 SSysQ=262 SAns=3540 SFwdQ=1619 SDupQ=39 SErr=0 RQ=3539 RIQ=0 RFwdQ=1619 RDupQ=1 RTCP=0 SFwdR=63 SFail=0 SFErr=0 SNaAns=3539 SNXD=381 RUQ=0 RURQ=0 RUXFR=0 RUUpd=0
2004:05:21-19:12:33 (none) named[8858]: starting (/etc/named.conf).  named 8.4.4 Wed Mar 31 18:47:49 CEST 2004  marcel@sles8:/home/marcel/packages/TMP/chroot-bind-5.0/bind/src/bin/named
2004:05:21-19:12:33 (none) named[8858]: hint zone "" (IN) loaded (serial 0)

Seems that the DNS proxy simply dies...
I manually enabled it..

Perhaps someone from Astaro can say something on this problem cause this no longer funny !

We plan to replace some Checkpoints at our office about 1000 machines. But with these problems I cannot plan this .

What´s up here ?

Alex

This thread was automatically locked due to age.

Parents

0 William Warren over 21 years ago

Are you using the http proxy as well? I have a wild theory...[:)]
Cancel
Vote Up 0 Vote Down

Cancel
0 alasc over 21 years ago in reply to William Warren

Hello,

yes I´m using transparent proxying...
What is your wild theory? I saw in the logs that sametime the syslog daemon was restarted aswell. ....

Greets Alex
Cancel
Vote Up 0 Vote Down

Cancel
0 alasc over 21 years ago in reply to William Warren

Hi William,

my machine has 384megs on a P3 650 30gig HDD.
At the time the DNS died there was absolutly no system or memory leak. There was enough free space on ram and hdd also.

Maybe someone from the ASTARO team can say something about that topic.

Thank you
Alex
Cancel
Vote Up 0 Vote Down

Cancel
0 William Warren over 21 years ago in reply to alasc

no a matter of memory leaks..squid likes to cache stuff to ram...hence why i applied this mod to v5. Try it..as i said it is wild but it worked here..[:)]
Cancel
Vote Up 0 Vote Down

Cancel
0 alasc over 21 years ago in reply to William Warren

OK,

I´ll keep it in mind. I have to wait till this error comes next time. I have to analyze then. Former times I did a reboot or solved the problem on console....
As I reinstalled from newest Image I hope this is already fixed.

So I have to hope and pray [:)]

Alex
Cancel
Vote Up 0 Vote Down

Cancel
0 THoehne over 21 years ago in reply to alasc

I have the same problem! The clients don't seem to be able to resolve the hostname anymore...

Restarted the DNS proxy a few times. Set HTTP Proxy to "standard" & "transaprent", but it's the same all the time.

I also noticed that ASL send packets to the clients from source port 53 to target port 10XX, but blocks hisself... I thought ASL should create a rule to let his DNS traffic pass! I then created a rule myself, to let this traffic pass, but no improvement!

How's it with the HTTP proxy anyway? Do i need working external DNS on the client machines when using HTTP proxy in standard mode?

I'm using v5.009.
Cancel
Vote Up 0 Vote Down

Cancel
0 William Warren over 21 years ago in reply to THoehne

did you try my squid tuning? I may have been a fluke but that solved the dns proxy crashing for me..[:)]
Cancel
Vote Up 0 Vote Down

Cancel
0 alasc over 21 years ago in reply to William Warren

Hi william,

maybe you solution works but I don´t like customize the ASL. I would like to have an update from ASTARO if something is not properly working. Otherwise I can bulid my own firewall machine. We had a self made former times....

Alex
Cancel
Vote Up 0 Vote Down

Cancel
0 THoehne over 21 years ago in reply to alasc

Sorry William, but that didn't solve the problem.

The HTTP Proxy is still not working. But I really think, this is because of the DNS proxy!!! Changed the DNS target IPs but no change!

This really has to be solved!
Cancel
Vote Up 0 Vote Down

Cancel
0 THoehne over 21 years ago in reply to THoehne

Once the client has solved the destination IP, the proxy is doing fine!
But as soon, as you quit the current page to a new one, it takes hours!
Cancel
Vote Up 0 Vote Down

Cancel
0 alasc over 21 years ago in reply to THoehne

This should be fixed soon!
Maybe someone from the ASL team should have a look at this thread.

Would be great !

Alex
Cancel
Vote Up 0 Vote Down

Cancel
0 William Warren over 21 years ago in reply to THoehne

oh well worth a shot..[:)] If the dns proxy is dying that is definitly serious. Have you run top via ssh shen this problem occurs to make sure the dns daemon is running?(or looked at hte process lsit in webadmin?)
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 William Warren over 21 years ago in reply to THoehne

oh well worth a shot..[:)] If the dns proxy is dying that is definitly serious. Have you run top via ssh shen this problem occurs to make sure the dns daemon is running?(or looked at hte process lsit in webadmin?)
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 THoehne over 21 years ago in reply to William Warren

It seems to be running, but with a very poor performance!
Cancel
Vote Up 0 Vote Down

Cancel
0 alasc over 21 years ago in reply to THoehne

Mine died...
see the logfile in the beginning of this thread....
Cancel
Vote Up 0 Vote Down

Cancel
0 alasc over 21 years ago in reply to alasc

Ups, he did it again. Exactly the same procedure as in the log at the beginning of this thread.
Last night I upgraded to V5.010 but ....

Please dear ASL Team say something on it

Alex
Cancel
Vote Up 0 Vote Down

Cancel
0 alasc over 21 years ago in reply to alasc

I posted it to [realname removed by oliver.desch] @ Astaro. Will see wht the support team says.

Alex
Cancel
Vote Up 0 Vote Down

Cancel
0 oliver.desch over 21 years ago in reply to alasc

alasc,

please respect individual privacy and avoid posting realnames here in the future, thank you for understanding.

Selfmonitoring for the nameserver doesn't work at the moment, I have reported the problem to our QA recently.

Under certain circumstances services have to restarted but normally the scripts should bring them up independently from the selfmonitoring system again.

Please contact me @ 'support @ astaro . com' and provide following information:

- do you use any dynamic definitions?
- pptp/IPSec connections?
- what did you do or what had happen on the firewall before named was shutdown?

read u
o|iver
Cancel
Vote Up 0 Vote Down

Cancel
0 alasc over 21 years ago in reply to oliver.desch

Hello Oliver,

sorry for this!
I will sent a mail to support @ astaro . com

Alex
Cancel
Vote Up 0 Vote Down

Cancel
0 THoehne over 21 years ago in reply to alasc

Spammer's best friend! [;)]
Cancel
Vote Up 0 Vote Down

Cancel