linux named进程 cpu占用过高解决方法

梦里梦外; 2021-09-07 06:16 1058阅读 0赞

解决方法

/usr/sbin/named -u named -g &

由named进程导致CPU使用过高问题

[![named占用CPU过高][named_CPU]][named_CPU_named_CPU]  
报错日志

Jun 26 10:26:03 localhost named[1906]: managed-keys-zone ./IN: sync_keyzone:dns_journal_open -> unexpected error
    Jun 26 10:26:12 localhost named[1906]: error (no valid RRSIG) resolving '168.192.in-addr.arpa/DS/IN': 8.8.8.8#53
    Jun 26 10:26:12 localhost named[1906]: error (network unreachable) resolving '168.192.in-addr.arpa/DS/IN': 2001:503:ba3e::2:30#53
    Jun 26 10:26:12 localhost named[1906]: error (network unreachable) resolving '168.192.in-addr.arpa/DS/IN': 2001:500:13::73#53
    Jun 26 10:26:12 localhost named[1906]: error (network unreachable) resolving '168.192.in-addr.arpa/DS/IN': 2001:500:87::87#53
    Jun 26 10:26:12 localhost named[1906]: error (network unreachable) resolving '168.192.in-addr.arpa/DS/IN': 2001:500:f0::63#53

此时僵尸进程14个

出现error (no valid RRSIG) 是因为安全设置的三个选项 (一般不需要开启着三个选项 可以直接注释)设置如下

dnssec-enable no;

dnssec-validation no;

dnssec-lookaside auto;

重启named

看日志 只剩一个错误

Jun 26 10:56:33 localhost named\[10967\]: managed-keys-zone ./IN: journal rollforward failed: unexpecte

看cpu占用依然很高

[root@ostaer named]# /usr/sbin/named -g &
    [1] 23304
    [root@ostaer named]# 26-Jun-2014 11:05:38.357 starting BIND 9.8.2rc1-RedHat-9.8.2-0.17.rc1.el6 -g
    26-Jun-2014 11:05:38.357 built with '--build=x86_64-redhat-linux-gnu' '--host=x86_64-redhat-linux-gnu' '--target=x86_64-redhat-linux-gnu' '--program-prefix=' '--prefix=/usr' '--exec-prefix=/usr' '--bindir=/usr/bin' '--sbindir=/usr/sbin' '--sysconfdir=/etc' '--datadir=/usr/share' '--includedir=/usr/include' '--libdir=/usr/lib64' '--libexecdir=/usr/libexec' '--sharedstatedir=/var/lib' '--mandir=/usr/share/man' '--infodir=/usr/share/info' '--with-libtool' '--localstatedir=/var' '--enable-threads' '--enable-ipv6' '--with-pic' '--disable-static' '--disable-openssl-version-check' '--with-dlz-ldap=yes' '--with-dlz-postgres=yes' '--with-dlz-mysql=yes' '--with-dlz-filesystem=yes' '--with-gssapi=yes' '--disable-isc-spnego' '--with-docbook-xsl=/usr/share/sgml/docbook/xsl-stylesheets' '--enable-fixed-rrset' 'build_alias=x86_64-redhat-linux-gnu' 'host_alias=x86_64-redhat-linux-gnu' 'target_alias=x86_64-redhat-linux-gnu' 'CFLAGS= -O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector --param=ssp-buffer-size=4 -m64 -mtune=generic' 'CPPFLAGS= -DDIG_SIGCHASE'
    26-Jun-2014 11:05:38.357 ----------------------------------------------------
    26-Jun-2014 11:05:38.357 BIND 9 is maintained by Internet Systems Consortium,
    26-Jun-2014 11:05:38.357 Inc. (ISC), a non-profit 501(c)(3) public-benefit 
    26-Jun-2014 11:05:38.357 corporation.  Support and training for BIND 9 are 
    26-Jun-2014 11:05:38.357 available at https://www.isc.org/support
    26-Jun-2014 11:05:38.357 ----------------------------------------------------
    26-Jun-2014 11:05:38.357 adjusted limit on open files from 4096 to 1048576
    26-Jun-2014 11:05:38.357 found 4 CPUs, using 4 worker threads
    26-Jun-2014 11:05:38.358 using up to 4096 sockets
    26-Jun-2014 11:05:38.365 loading configuration from '/etc/named.conf'
    26-Jun-2014 11:05:38.365 /etc/named.conf:13: change directory to '/var/named' failed: permission denied
    26-Jun-2014 11:05:38.365 /etc/named.conf:13: parsing failed
    26-Jun-2014 11:05:38.396 loading configuration: permission denied
    26-Jun-2014 11:05:38.396 exiting (due to fatal error)
    ^C
    [1]+  Exit 1               /usr/sbin/named -g

提示/etc/named.conf:13: change directory to '/var/named' failed: permission denied

检查区域文件权限

[root@ostaer named]# ll -d /var/named
    drwxr-x---. 6 named named 4096 Jun 26 11:17 /var/named

正确

以named用户运行

[root@ostaer named]# /usr/sbin/named -u named -g &
    [1] 31401
    [root@ostaer named]# 26-Jun-2014 11:11:50.100 starting BIND 9.8.2rc1-RedHat-9.8.2-0.17.rc1.el6 -u named -g
    26-Jun-2014 11:11:50.100 built with '--build=x86_64-redhat-linux-gnu' '--host=x86_64-redhat-linux-gnu' '--target=x86_64-redhat-linux-gnu' '--program-prefix=' '--prefix=/usr' '--exec-prefix=/usr' '--bindir=/usr/bin' '--sbindir=/usr/sbin' '--sysconfdir=/etc' '--datadir=/usr/share' '--includedir=/usr/include' '--libdir=/usr/lib64' '--libexecdir=/usr/libexec' '--sharedstatedir=/var/lib' '--mandir=/usr/share/man' '--infodir=/usr/share/info' '--with-libtool' '--localstatedir=/var' '--enable-threads' '--enable-ipv6' '--with-pic' '--disable-static' '--disable-openssl-version-check' '--with-dlz-ldap=yes' '--with-dlz-postgres=yes' '--with-dlz-mysql=yes' '--with-dlz-filesystem=yes' '--with-gssapi=yes' '--disable-isc-spnego' '--with-docbook-xsl=/usr/share/sgml/docbook/xsl-stylesheets' '--enable-fixed-rrset' 'build_alias=x86_64-redhat-linux-gnu' 'host_alias=x86_64-redhat-linux-gnu' 'target_alias=x86_64-redhat-linux-gnu' 'CFLAGS= -O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector --param=ssp-buffer-size=4 -m64 -mtune=generic' 'CPPFLAGS= -DDIG_SIGCHASE'
    26-Jun-2014 11:11:50.100 ----------------------------------------------------
    26-Jun-2014 11:11:50.100 BIND 9 is maintained by Internet Systems Consortium,
    26-Jun-2014 11:11:50.100 Inc. (ISC), a non-profit 501(c)(3) public-benefit 
    26-Jun-2014 11:11:50.100 corporation.  Support and training for BIND 9 are 
    26-Jun-2014 11:11:50.100 available at https://www.isc.org/support
    26-Jun-2014 11:11:50.100 ----------------------------------------------------
    26-Jun-2014 11:11:50.100 adjusted limit on open files from 4096 to 1048576
    26-Jun-2014 11:11:50.100 found 4 CPUs, using 4 worker threads
    26-Jun-2014 11:11:50.103 using up to 4096 sockets
    26-Jun-2014 11:11:50.112 loading configuration from '/etc/named.conf'
    26-Jun-2014 11:11:50.113 reading built-in trusted keys from file '/etc/named.iscdlv.key'
    26-Jun-2014 11:11:50.115 using default UDP/IPv4 port range: [1024, 65535]
    26-Jun-2014 11:11:50.115 using default UDP/IPv6 port range: [1024, 65535]
    26-Jun-2014 11:11:50.237 listening on IPv4 interface lo, 127.0.0.1#53
    26-Jun-2014 11:11:50.243 listening on IPv4 interface eth0, 172.16.7.129#53
    26-Jun-2014 11:11:50.280 listening on IPv6 interface lo, ::1#53
    26-Jun-2014 11:11:50.324 Could not open '/var/run/named/named.pid'.
    26-Jun-2014 11:11:50.324 Please check file and directory permissions or reconfigure the filename.
    26-Jun-2014 11:11:50.324 could not open file '/var/run/named/named.pid': Permission denied
    26-Jun-2014 11:11:50.324 generating session key for dynamic DNS
    26-Jun-2014 11:11:50.324 Could not open '/var/run/named/session.key'.
    26-Jun-2014 11:11:50.325 Please check file and directory permissions or reconfigure the filename.
    26-Jun-2014 11:11:50.325 could not open file '/var/run/named/session.key': Permission denied
    26-Jun-2014 11:11:50.325 could not create /var/run/named/session.key
    26-Jun-2014 11:11:50.325 failed to generate session key for dynamic DNS: permission denied
    26-Jun-2014 11:11:50.325 sizing zone task pool based on 7 zones
    26-Jun-2014 11:11:50.379 using built-in DLV key for view _default
    26-Jun-2014 11:11:50.380 set up managed keys zone for view _default, file '/var/named/dynamic/managed-keys.bind'
    26-Jun-2014 11:11:50.380 Warning: 'empty-zones-enable/disable-empty-zone' not set: disabling RFC 1918 empty zones
    26-Jun-2014 11:11:50.380 automatic empty zone: 127.IN-ADDR.ARPA
    26-Jun-2014 11:11:50.381 automatic empty zone: 254.169.IN-ADDR.ARPA
    26-Jun-2014 11:11:50.381 automatic empty zone: 2.0.192.IN-ADDR.ARPA
    26-Jun-2014 11:11:50.381 automatic empty zone: 100.51.198.IN-ADDR.ARPA
    26-Jun-2014 11:11:50.381 automatic empty zone: 113.0.203.IN-ADDR.ARPA
    26-Jun-2014 11:11:50.381 automatic empty zone: 255.255.255.255.IN-ADDR.ARPA
    26-Jun-2014 11:11:50.381 automatic empty zone: 0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.IP6.ARPA
    26-Jun-2014 11:11:50.381 automatic empty zone: D.F.IP6.ARPA
    26-Jun-2014 11:11:50.381 automatic empty zone: 8.E.F.IP6.ARPA
    26-Jun-2014 11:11:50.381 automatic empty zone: 9.E.F.IP6.ARPA
    26-Jun-2014 11:11:50.381 automatic empty zone: A.E.F.IP6.ARPA
    26-Jun-2014 11:11:50.381 automatic empty zone: B.E.F.IP6.ARPA
    26-Jun-2014 11:11:50.381 automatic empty zone: 8.B.D.0.1.0.0.2.IP6.ARPA
    26-Jun-2014 11:11:50.471 command channel listening on 127.0.0.1#953
    26-Jun-2014 11:11:50.471 command channel listening on ::1#953
    26-Jun-2014 11:11:50.555 ignoring config file logging statement due to -g option
    26-Jun-2014 11:11:50.563 zone 0.in-addr.arpa/IN: loaded serial 0
    26-Jun-2014 11:11:50.568 zone 1.0.0.127.in-addr.arpa/IN: loaded serial 0
    26-Jun-2014 11:11:50.569 zone 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa/IN: loaded serial 0
    26-Jun-2014 11:11:50.574 zone localhost.localdomain/IN: loaded serial 0
    26-Jun-2014 11:11:50.574 zone localhost/IN: loaded serial 0
    26-Jun-2014 11:11:50.574 zone sirun.net/IN: loading from master file sirun.net.zone failed: file not found
    26-Jun-2014 11:11:50.574 zone sirun.net/IN: not loaded due to errors.
    26-Jun-2014 11:11:50.618 managed-keys-zone ./IN: loaded serial 0
    26-Jun-2014 11:11:50.627 running

没有报错 查看CPU 已经恢复正常

查看僵尸进程\# ps -ef |grep -e '^\[zZ\]'

结果：没有僵尸进程

总结:

原因未知 报错无法重现

原named服务可能被强制以root执行

查看named进程 需要注意权限问题

[root@ostaer init.d]# ps -ef | grep named | grep -v grep
    named    15480     1  0 11:23 ?       00:00:00 /usr/sbin/named -u named -t /var/named/chroot

[named_CPU]: https://img-blog.csdnimg.cn/img_convert/8a0f8e71302f271213c50cb1fe7d5abd.png
[named_CPU_named_CPU]: /images/20210728/edc9d7d8ca9f42f5b39db58048bc8700.png