TCP buffers keep filling up (Recv-Q full): named unresponsive

Question

Using netstat -an, I set the message that the Recv-Q is full. It is filling up to the rmem_max:

Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address               Foreign Address             State      
udp   1894912      0 10.0.64.150:53              0.0.0.0:*

(it keeps 'filling' until it crashes)

Sizes:

/proc/sys/net/core/optmem_max:20480
/proc/sys/net/core/rmem_default:8388608
/proc/sys/net/core/rmem_max:8388608
/proc/sys/net/core/wmem_default:229376
/proc/sys/net/core/wmem_max:229376

Result in netstat -su:

Udp:
426057 packets received
37152 packets to unknown port received.
2350589 packet receive errors
517422 packets sent

Who has an idea?

Answer 1

Apparently there was a problem with logging. I set the dns server to log to rsyslog. While stracing, the file descriptor for syslog didn't seem to 'work'.

Solved by making bind log to local file:

logging{
  channel bindlog {
    file "/var/log/named/bind.log" versions 3 size 5m;
    severity info;
    print-time yes;
    print-severity yes;
    print-category yes;
  };
  category default{
    bindlog;
  };
};

Answer 2

This means that your network card and kernel are able to receive the packets fine, but whatever your DNS server is, or whatever server is listening on UDP 53 is not reading from the UDP socket often or quickly enough.