zone transfer delay

[project722]

I've got two recursive dns servers running ISC 9.11 and 9.12. We are using
RPZ and I have a whitelist/blacklist exception zone file on both servers. I
need the ability to change it only on one server and have it propogate to
the other servers. My config is working, but I'm getting some delays that
i'd like to eliminate. First off, on the "master" server, when I update the
rpz-local file and run a rndc reload, it takes about 2 minutes before I see
the xfer-out in the logs. On the "slave", I also see the xfer-in at the
same time. There are no errors, just that kickoff delay.

Then, on the "slave", it takes about 15 minutes for the file to actaully
update with the new info from the time of the xfer-in. I've tried adding NS
records for the slave in the zone file and doing some things with notify,
but nothing seems to help. I'd like the changes to be almost instantaneous
from the time I run the rndc relaod. Here is the config from the "master".

/etc/named.conf
acl RPZ {
192.168.1.100;
};

zone "rpz-local" {
type master;
file "db.rpz-local";
allow-transfer { localhost; RPZ; };
allow-query { localhost; RPZ; };
};

zone file:
$TTL 150

@ IN SOA localhost. need.to.know.only. (
201707314 ; Serial number
10 ; Refresh every 10 seconds
10 ; Retry every 30 seconds
432000 ; Expire in 5 days
60 ) ; negative caching ttl 1 minute

IN NS ns1master.example.com
IN NS ns2slave.example.com

;# -------------------------------------------------------------------
;# Whitelist entries using rpz-passthru
;# -------------------------------------------------------------------

deteque.com IN CNAME rpz-passthru.
*.deteque.com IN CNAME rpz-passthru.


Here is the config from the slave:

/etc/named.conf
acl RPZ {
192.168.1.101;
};

zone "rpz-local" {
type slave;
file "db.rpz-local";
masters { 192.168.1.101; };
allow-transfer { localhost; RPZ; };
masterfile-format text;
allow-query { localhost; RPZ; };
};

[project722]

I've added those 2 lines to the master in the zone info section. It seemed
to have helped with the delay with the server announcing the change and
initiating the xfer-out. But the slave still takes @15 minutes for the new
data to get populated in the file.

Post by project722
Then, on the "slave", it takes about 15 minutes for the file to actaully
update with the new info from the time of the xfer-in. I've tried adding
NS records for the slave in the zone file and doing some things with
notify, but nothing seems to help. I'd like the changes to be almost
instantaneous from the time I run the rndc relaod. Here is the config
from the "master"

we have this on all our nameserver-pairs for years and it works perfect
notify explicit;
also-notify {ip-of-slave;};
also make soure you always increase the zone-serial

[Tony Finch]

Post by project722
in the file.

Use `dig axfr` or `named-compilezone -j` to get the server's view of the
zone. Zone updates are written to a journal and are not incorporated into
the zone file immediately.

Tony.

[project722]

Are you saying do a zone xfer then check the slave with the commands above
to see what it actaully returns? Instead of checking the file itself?
Sounds like to me you are saying that the server would return the updated
data, because its in the journal file, regardless of whether its made it
into the regular zone file yet. Is that a correct assumption?

Post by Tony Finch

Post by project722
in the file.

Use `dig axfr` or `named-compilezone -j` to get the server's view of the
zone. Zone updates are written to a journal and are not incorporated into
the zone file immediately.
Tony.
--
fight poverty, oppression, hunger, ignorance, disease, and aggression

[Tony Finch]

Post by project722
Sounds like to me you are saying that the server would return the updated
data, because its in the journal file, regardless of whether its made it
into the regular zone file yet.

Yes, that's how it works.

Tony.
--
f.anthony.n.finch <***@dotat.at> http://dotat.at/
South Fitzroy: Variable 4. Moderate or rough. Fog patches. Moderate,
occasionally very poor.
_______________________________________________
Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list

bind-users mailing list
bind-***@lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users

[project722]

Ok, is this something new to the later BIND versions? I'm looking on our
authoritative servers running the red hat bind 9.8.2 and do not see any
.jnl files.

Also, I made a zone transfer and ran a dig axfr rpz-local @ipaddress and it
returned the updated data, while the file remained unchanged. (for now)

Post by Tony Finch

Post by project722
Sounds like to me you are saying that the server would return the updated
data, because its in the journal file, regardless of whether its made it
into the regular zone file yet.

Yes, that's how it works.
Tony.
--
South Fitzroy: Variable 4. Moderate or rough. Fog patches. Moderate,
occasionally very poor.

[project722]

Yes, I seem to be learning that the hard way:) My shop is still on Bind
9.8.2 (Red Hat) on our authoritative servers. These new features in 9.11
are nice!

Post by project722
Are you saying do a zone xfer then check the slave with the commands
above to see what it actaully returns? Instead of checking the file
itself? Sounds like to me you are saying that the server would return
the updated data, because its in the journal file, regardless of whether
its made it into the regular zone file yet. Is that a correct assumption?

surely!
how do you come to the idea to look at zone files instead use "dig"?
on most setups the slave zones are even not human readable these days