On 8/17/09 10:15 PM, Fajar A. Nugraha wrote:
Here are some pointers from my experience though:
- syslog query logging is expensive. NEVER enable it. If you need to
log client queries, log it directly to file instead.
I would like to hear more about why this is so. We are currently
debating sending query logs to a remote syslog server to enhance some
security tools. We are running BIND 9.6.1-P1 with multithreading enabled
on RHEL 4 (2 dual-core 2.8 GHz Opterons with 1MB cache, 4G of RAM). I
have run some tests and while there is some queries/sec hit, the RTTs
are not terrible.
---------------------------------------------------------------------
queryperf -d input/queries.log.34 -s hidden.server -q 200 -l 300 -b 32
running 9.6.1-P1 with querylogging on and directed to remote syslog
Statistics:
Parse input file: multiple times
Run time limit: 300 seconds
Ran through file: 0 times
Queries sent: 746189 queries
Queries completed: 739501 queries
Queries lost: 6688 queries
Queries delayed(?): 0 queries
RTT max: 5.003000 sec
RTT min: 0.000197 sec
RTT average: 0.036471 sec
RTT std deviation: 0.204566 sec
RTT out of range: 1 queries
Percentage completed: 99.10%
Percentage lost: 0.90%
Started at: Tue Aug 18 11:22:50 2009
Finished at: Tue Aug 18 11:27:55 2009
Ran for: 304.900344 seconds
Queries per second: 2425.385916 qps
---------------------------------------------------------------------
cache flushed
queryperf -d input/queries.log.34 -s hidden.server -q 200 -l 300 -b 32
running 9.6.1-P1 with querylogging on and directed to local disk
Statistics:
Parse input file: multiple times
Run time limit: 300 seconds
Ran through file: 0 times
Queries sent: 982436 queries
Queries completed: 973645 queries
Queries lost: 8791 queries
Queries delayed(?): 0 queries
RTT max: 4.999350 sec
RTT min: 0.000219 sec
RTT average: 0.016778 sec
RTT std deviation: 0.152307 sec
RTT out of range: 0 queries
Percentage completed: 99.11%
Percentage lost: 0.89%
Started at: Tue Aug 18 11:29:08 2009
Finished at: Tue Aug 18 11:34:13 2009
Ran for: 304.979150 seconds
Queries per second: 3192.496930 qps
---------------------------------------------------------------------
cache flushed
queryperf -d input/queries.log.34 -s hidden.server -q 200 -l 300 -b 32
running 9.6.1-P1 with querylogging off
Statistics:
Parse input file: multiple times
Run time limit: 300 seconds
Ran through file: 0 times
Queries sent: 1027578 queries
Queries completed: 1018243 queries
Queries lost: 9335 queries
Queries delayed(?): 0 queries
RTT max: 5.043680 sec
RTT min: 0.000008 sec
RTT average: 0.013455 sec
RTT std deviation: 0.142308 sec
RTT out of range: 1 queries
Percentage completed: 99.09%
Percentage lost: 0.91%
Started at: Tue Aug 18 11:35:27 2009
Finished at: Tue Aug 18 11:40:32 2009
Ran for: 304.932400 seconds
Queries per second: 3339.241747 qps
---------------------------------------------------------------------
This server is a caching-forwarder with max-cache-ttl (and
max-ncache-ttl) set to 15 mins. It has 4G of memory with no limit
enforced in named.conf.
version: 9.6.1-P1
CPUs found: 4
worker threads: 4
number of zones: 12
debug level: 0
xfers running: 0
xfers deferred: 0
soa queries in progress: 0
query logging is ON
recursive clients: 0/5900/6000
tcp clients: 0/100
server is up and running
_______________________________________________
bind-users mailing list
bind-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users
