Using netstat -an, I set the message that the Recv-Q is full. It is filling up to the rmem_max:

Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address               Foreign Address             State      
udp   1894912      0    *

(it keeps 'filling' until it crashes)



Result in netstat -su:

426057 packets received
37152 packets to unknown port received.
2350589 packet receive errors
517422 packets sent

Who has an idea?

  • 1
    strace it, dude
    – poige
    Nov 12, 2013 at 16:55
  • What am I looking for? IIRC, I was getting lots of EAGAIN messages.
    – Karel
    Nov 12, 2013 at 18:28
  • It sounds like your BIND isn't able to keep up with the incoming queries...
    – derobert
    Nov 12, 2013 at 19:34
  • All mediums are currently on vacation, so unless you're giving us ( usual people) normal output (dpaste.com is ok for strace), your chances to get "the idea" are too ghostly. )
    – poige
    Nov 13, 2013 at 1:50
  • Does this help: pastebin.com/raw.php?i=0HrW49i7 ?
    – Karel
    Nov 13, 2013 at 10:23

2 Answers 2


Apparently there was a problem with logging. I set the dns server to log to rsyslog. While stracing, the file descriptor for syslog didn't seem to 'work'.

Solved by making bind log to local file:

  channel bindlog {
    file "/var/log/named/bind.log" versions 3 size 5m;
    severity info;
    print-time yes;
    print-severity yes;
    print-category yes;
  category default{

This means that your network card and kernel are able to receive the packets fine, but whatever your DNS server is, or whatever server is listening on UDP 53 is not reading from the UDP socket often or quickly enough.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.