PowerDNS slaves not updating after being notified The 2019 Stack Overflow Developer Survey Results Are In Announcing the arrival of Valued Associate #679: Cesar Manara Planned maintenance scheduled April 17/18, 2019 at 00:00UTC (8:00pm US/Eastern) Come Celebrate our 10 Year Anniversary!PowerDNS, updating serialPowerdns not using packetcachePowerDNS master server doesn't notifypowerdns does not resolve country TLD like .com.autrying to send a query to powerdns and expected result not being returnedPowerDNS not listeningPowerDNS different DNSSEC signatures on slavesDoes one need to reload PowerDNS after editing the conf file?pdns (powerdns) not returning records anymore after switching db backends
How to support a colleague who finds meetings extremely tiring?
What can I do if neighbor is blocking my solar panels intentionally?
Why doesn't a hydraulic lever violate conservation of energy?
Why can't devices on different VLANs, but on the same subnet, communicate?
Identify 80s or 90s comics with ripped creatures (not dwarves)
Using dividends to reduce short term capital gains?
Didn't get enough time to take a Coding Test - what to do now?
Windows 10: How to Lock (not sleep) laptop on lid close?
Presidential Pardon
Keeping a retro style to sci-fi spaceships?
Are spiders unable to hurt humans, especially very small spiders?
Example of compact Riemannian manifold with only one geodesic.
Would an alien lifeform be able to achieve space travel if lacking in vision?
Accepted by European university, rejected by all American ones I applied to? Possible reasons?
Store Dynamic-accessible hidden metadata in a cell
Why can't wing-mounted spoilers be used to steepen approaches?
The following signatures were invalid: EXPKEYSIG 1397BC53640DB551
What force causes entropy to increase?
Is there a way to generate uniformly distributed points on a sphere from a fixed amount of random real numbers per point?
How many cones with angle theta can I pack into the unit sphere?
How do I design a circuit to convert a 100 mV and 50 Hz sine wave to a square wave?
Single author papers against my advisor's will?
Does Parliament hold absolute power in the UK?
how can a perfect fourth interval be considered either consonant or dissonant?
PowerDNS slaves not updating after being notified
The 2019 Stack Overflow Developer Survey Results Are In
Announcing the arrival of Valued Associate #679: Cesar Manara
Planned maintenance scheduled April 17/18, 2019 at 00:00UTC (8:00pm US/Eastern)
Come Celebrate our 10 Year Anniversary!PowerDNS, updating serialPowerdns not using packetcachePowerDNS master server doesn't notifypowerdns does not resolve country TLD like .com.autrying to send a query to powerdns and expected result not being returnedPowerDNS not listeningPowerDNS different DNSSEC signatures on slavesDoes one need to reload PowerDNS after editing the conf file?pdns (powerdns) not returning records anymore after switching db backends
.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty height:90px;width:728px;box-sizing:border-box;
4
I'm running two machines with PowerDNS, one being the master (SQL) and one being the slave (Bind backend).
After I modify a domain and bump the serial, I get this in the log:
Sep 30 22:13:20 localhost pdns[6884]: 1 domain for which we are master needs notifications
Sep 30 22:13:20 localhost pdns[6884]: Queued notification of domain 'netly.io' to 146.185.146.149
Sep 30 22:13:20 localhost pdns[6884]: Queued notification of domain 'netly.io' to 146.185.147.74
Sep 30 22:13:20 localhost pdns[6884]: Received NOTIFY for netly.io from 146.185.146.149 but slave support is disabled in the configuration
Sep 30 22:13:21 localhost pdns[6884]: Received unsuccessful notification report for 'netly.io' from 146.185.146.149:53, rcode: 4
Sep 30 22:13:21 localhost pdns[6884]: Removed from notification list: 'netly.io' to 146.185.146.149:53
Sep 30 22:13:23 localhost pdns[6884]: No master domains need notifications
I understand it's notifying itself (146.185.146.149) because it is set as nameserver, and that those errors can be ignored.
It (looks like) notifies the other server (146.185.147.74 or 162.243.29.199) as well.
However, the slave doesn't show anything in the log around that time frame, and when I cat the domain file, I can see the old serial and the subdomain not being updated.
dig @slave-server also shows the old settings.
telling it to reload also doesn't update the bind zone file:
slave-server # pdns_control reload
Ok
slave-server # tail -f /var/log/daemon.log
Sep 30 22:21:28 node-e31401 pdns[2259]: Zone 'netly.io' (/etc/powerdns/bind/netly.io.) needs reloading
Sep 30 22:21:28 node-e31401 pdns[2259]: Zone 'netly.io' (/etc/powerdns/bind/netly.io.) reloaded
However, when I entirely restart PDNS it finally figures out it is outdated and correctly fetches the updated zone:
slave-server # /etc/init.d/pdns restart
[ ok ] Restarting PowerDNS Authoritative Name Server: pdns.
slave-server # tail -f /var/log/daemon.log
Sep 30 22:23:48 node-e31401 pdns[2911]: 2 slave domains need checking, 0 queued for AXFR
Sep 30 22:23:48 node-e31401 pdns[2911]: Received serial number updates for 2 zones, had 0 timeouts
Sep 30 22:23:48 node-e31401 pdns[2911]: Domain netly.io is stale, master serial 2013093004, our serial 2013093003
Sep 30 22:23:48 node-e31401 pdns[2911]: Domain titify.com is fresh (not presigned, no RRSIG check)
Sep 30 22:23:48 node-e31401 pdns[2911]: No master domains need notifications
Sep 30 22:23:48 node-e31401 pdns[2911]: Initiating transfer of 'netly.io' from remote '146.185.146.149'
Sep 30 22:23:48 node-e31401 pdns[2911]: AXFR started for 'netly.io', transaction started
Sep 30 22:23:48 node-e31401 pdns[2911]: Zone 'netly.io' (/etc/powerdns/bind/netly.io.) reloaded
Sep 30 22:23:48 node-e31401 pdns[2911]: AXFR done for 'netly.io', zone committed with serial number 2013093004
Sep 30 22:23:48 node-e31401 pdns[2911]: Done launching threads, ready to distribute questions
What am I missing here? What is causing the master to correctly notify the slave, but the slave not to fetch the new zone?
Edit:
- Slave config: https://static.0x04.com/2013/10/slave.pdns_.txt
- Master config: https://static.0x04.com/2013/10/master.pdns_.txt
tcpdump:
node-fd1d01 ~ # tcpdump -n 'host 146.185.146.149 and port 53'
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
09:51:38.042713 IP 146.185.146.149.42478 > 162.243.29.199.53: 61745 notify [b2&3=0x2400] SOA? netly.io. (26)
09:51:41.043323 IP 146.185.146.149.42478 > 162.243.29.199.53: 61745 notify [b2&3=0x2400] SOA? netly.io. (26)
09:51:46.044145 IP 146.185.146.149.42478 > 162.243.29.199.53: 61745 notify [b2&3=0x2400] SOA? netly.io. (26)
09:51:52.049533 IP 146.185.146.149.42478 > 162.243.29.199.53: 59408 notify [b2&3=0x2400] SOA? netly.io. (26)
09:51:55.050715 IP 146.185.146.149.42478 > 162.243.29.199.53: 61745 notify [b2&3=0x2400] SOA? netly.io. (26)
09:51:55.050753 IP 146.185.146.149.42478 > 162.243.29.199.53: 59408 notify [b2&3=0x2400] SOA? netly.io. (26)
09:52:00.053327 IP 146.185.146.149.42478 > 162.243.29.199.53: 59408 notify [b2&3=0x2400] SOA? netly.io. (26)
09:52:09.056321 IP 146.185.146.149.42478 > 162.243.29.199.53: 59408 notify [b2&3=0x2400] SOA? netly.io. (26)
Log doesn't show anything new (latest at 09h48):
node-fd1d01 /etc/powerdns/bind # tail -f /var/log/daemon.log
Oct 2 09:47:59 localhost pdns[2253]: Domain netly.io is fresh (not presigned, no RRSIG check)
Oct 2 09:47:59 localhost pdns[2253]: Domain titify.com is fresh (not presigned, no RRSIG check)
Oct 2 09:47:59 localhost pdns[2253]: No master domains need notifications
Oct 2 09:47:59 localhost pdns[2253]: Done launching threads, ready to distribute questions
Oct 2 09:48:00 localhost ntpd[2144]: Listen normally on 6 tun0 172.17.24.1 UDP 123
Oct 2 09:48:00 localhost ntpd[2144]: Listen normally on 7 tun1 172.17.16.1 UDP 123
Oct 2 09:48:00 localhost ntpd[2144]: peers refreshed
Oct 2 09:48:12 localhost dbus[2093]: [system] Activating service name='org.freedesktop.ConsoleKit' (using servicehelper)
Oct 2 09:48:12 localhost dbus[2093]: [system] Successfully activated service 'org.freedesktop.ConsoleKit'
Oct 2 09:48:59 localhost pdns[2253]: No new unfresh slave domains, 0 queued for AXFR already
But when I cat the zone file (in Bind format) it's not updated.
powerdns
asked Sep 30 '13 at 22:26
TuinslakTuinslak
87272146
|
show 3 more comments
4
I'm running two machines with PowerDNS, one being the master (SQL) and one being the slave (Bind backend).
After I modify a domain and bump the serial, I get this in the log:
Sep 30 22:13:20 localhost pdns[6884]: 1 domain for which we are master needs notifications
Sep 30 22:13:20 localhost pdns[6884]: Queued notification of domain 'netly.io' to 146.185.146.149
Sep 30 22:13:20 localhost pdns[6884]: Queued notification of domain 'netly.io' to 146.185.147.74
Sep 30 22:13:20 localhost pdns[6884]: Received NOTIFY for netly.io from 146.185.146.149 but slave support is disabled in the configuration
Sep 30 22:13:21 localhost pdns[6884]: Received unsuccessful notification report for 'netly.io' from 146.185.146.149:53, rcode: 4
Sep 30 22:13:21 localhost pdns[6884]: Removed from notification list: 'netly.io' to 146.185.146.149:53
Sep 30 22:13:23 localhost pdns[6884]: No master domains need notifications
I understand it's notifying itself (146.185.146.149) because it is set as nameserver, and that those errors can be ignored.
It (looks like) notifies the other server (146.185.147.74 or 162.243.29.199) as well.
However, the slave doesn't show anything in the log around that time frame, and when I cat the domain file, I can see the old serial and the subdomain not being updated.
dig @slave-server also shows the old settings.
telling it to reload also doesn't update the bind zone file:
slave-server # pdns_control reload
Ok
slave-server # tail -f /var/log/daemon.log
Sep 30 22:21:28 node-e31401 pdns[2259]: Zone 'netly.io' (/etc/powerdns/bind/netly.io.) needs reloading
Sep 30 22:21:28 node-e31401 pdns[2259]: Zone 'netly.io' (/etc/powerdns/bind/netly.io.) reloaded
However, when I entirely restart PDNS it finally figures out it is outdated and correctly fetches the updated zone:
slave-server # /etc/init.d/pdns restart
[ ok ] Restarting PowerDNS Authoritative Name Server: pdns.
slave-server # tail -f /var/log/daemon.log
Sep 30 22:23:48 node-e31401 pdns[2911]: 2 slave domains need checking, 0 queued for AXFR
Sep 30 22:23:48 node-e31401 pdns[2911]: Received serial number updates for 2 zones, had 0 timeouts
Sep 30 22:23:48 node-e31401 pdns[2911]: Domain netly.io is stale, master serial 2013093004, our serial 2013093003
Sep 30 22:23:48 node-e31401 pdns[2911]: Domain titify.com is fresh (not presigned, no RRSIG check)
Sep 30 22:23:48 node-e31401 pdns[2911]: No master domains need notifications
Sep 30 22:23:48 node-e31401 pdns[2911]: Initiating transfer of 'netly.io' from remote '146.185.146.149'
Sep 30 22:23:48 node-e31401 pdns[2911]: AXFR started for 'netly.io', transaction started
Sep 30 22:23:48 node-e31401 pdns[2911]: Zone 'netly.io' (/etc/powerdns/bind/netly.io.) reloaded
Sep 30 22:23:48 node-e31401 pdns[2911]: AXFR done for 'netly.io', zone committed with serial number 2013093004
Sep 30 22:23:48 node-e31401 pdns[2911]: Done launching threads, ready to distribute questions
What am I missing here? What is causing the master to correctly notify the slave, but the slave not to fetch the new zone?
Edit:
- Slave config: https://static.0x04.com/2013/10/slave.pdns_.txt
- Master config: https://static.0x04.com/2013/10/master.pdns_.txt
tcpdump:
node-fd1d01 ~ # tcpdump -n 'host 146.185.146.149 and port 53'
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
09:51:38.042713 IP 146.185.146.149.42478 > 162.243.29.199.53: 61745 notify [b2&3=0x2400] SOA? netly.io. (26)
09:51:41.043323 IP 146.185.146.149.42478 > 162.243.29.199.53: 61745 notify [b2&3=0x2400] SOA? netly.io. (26)
09:51:46.044145 IP 146.185.146.149.42478 > 162.243.29.199.53: 61745 notify [b2&3=0x2400] SOA? netly.io. (26)
09:51:52.049533 IP 146.185.146.149.42478 > 162.243.29.199.53: 59408 notify [b2&3=0x2400] SOA? netly.io. (26)
09:51:55.050715 IP 146.185.146.149.42478 > 162.243.29.199.53: 61745 notify [b2&3=0x2400] SOA? netly.io. (26)
09:51:55.050753 IP 146.185.146.149.42478 > 162.243.29.199.53: 59408 notify [b2&3=0x2400] SOA? netly.io. (26)
09:52:00.053327 IP 146.185.146.149.42478 > 162.243.29.199.53: 59408 notify [b2&3=0x2400] SOA? netly.io. (26)
09:52:09.056321 IP 146.185.146.149.42478 > 162.243.29.199.53: 59408 notify [b2&3=0x2400] SOA? netly.io. (26)
Log doesn't show anything new (latest at 09h48):
node-fd1d01 /etc/powerdns/bind # tail -f /var/log/daemon.log
Oct 2 09:47:59 localhost pdns[2253]: Domain netly.io is fresh (not presigned, no RRSIG check)
Oct 2 09:47:59 localhost pdns[2253]: Domain titify.com is fresh (not presigned, no RRSIG check)
Oct 2 09:47:59 localhost pdns[2253]: No master domains need notifications
Oct 2 09:47:59 localhost pdns[2253]: Done launching threads, ready to distribute questions
Oct 2 09:48:00 localhost ntpd[2144]: Listen normally on 6 tun0 172.17.24.1 UDP 123
Oct 2 09:48:00 localhost ntpd[2144]: Listen normally on 7 tun1 172.17.16.1 UDP 123
Oct 2 09:48:00 localhost ntpd[2144]: peers refreshed
Oct 2 09:48:12 localhost dbus[2093]: [system] Activating service name='org.freedesktop.ConsoleKit' (using servicehelper)
Oct 2 09:48:12 localhost dbus[2093]: [system] Successfully activated service 'org.freedesktop.ConsoleKit'
Oct 2 09:48:59 localhost pdns[2253]: No new unfresh slave domains, 0 queued for AXFR already
But when I cat the zone file (in Bind format) it's not updated.
powerdns
asked Sep 30 '13 at 22:26
TuinslakTuinslak
87272146
The initial post got updated with the configs.
– Tuinslak
Oct 1 '13 at 18:21
Make sure the notify from master to slave isn't blocked by any firewall.
– Stefan
Oct 2 '13 at 7:34
TCP/53, right? Those ports are open.
– Tuinslak
Oct 2 '13 at 7:56
1
Notify uses UDP/53 (master: random port, slave: port 53). you could watch withtcpdump -n 'host 146.185.146.149 and port 53'on your slave, and triggerpdns_control notify netly.ioon the master.
– Stefan
Oct 2 '13 at 8:28
1
Your secondaries (*.titify.com) seem to be entirely unreachable from the Internet. Not sure this is causing your problem, but it certainly doesn't help. Also makes it hard to debug from the outside.
– Habbie
Oct 3 '13 at 10:07
|
show 3 more comments
4
4
4
I'm running two machines with PowerDNS, one being the master (SQL) and one being the slave (Bind backend).
After I modify a domain and bump the serial, I get this in the log:
Sep 30 22:13:20 localhost pdns[6884]: 1 domain for which we are master needs notifications
Sep 30 22:13:20 localhost pdns[6884]: Queued notification of domain 'netly.io' to 146.185.146.149
Sep 30 22:13:20 localhost pdns[6884]: Queued notification of domain 'netly.io' to 146.185.147.74
Sep 30 22:13:20 localhost pdns[6884]: Received NOTIFY for netly.io from 146.185.146.149 but slave support is disabled in the configuration
Sep 30 22:13:21 localhost pdns[6884]: Received unsuccessful notification report for 'netly.io' from 146.185.146.149:53, rcode: 4
Sep 30 22:13:21 localhost pdns[6884]: Removed from notification list: 'netly.io' to 146.185.146.149:53
Sep 30 22:13:23 localhost pdns[6884]: No master domains need notifications
I understand it's notifying itself (146.185.146.149) because it is set as nameserver, and that those errors can be ignored.
It (looks like) notifies the other server (146.185.147.74 or 162.243.29.199) as well.
However, the slave doesn't show anything in the log around that time frame, and when I cat the domain file, I can see the old serial and the subdomain not being updated.
dig @slave-server also shows the old settings.
telling it to reload also doesn't update the bind zone file:
slave-server # pdns_control reload
Ok
slave-server # tail -f /var/log/daemon.log
Sep 30 22:21:28 node-e31401 pdns[2259]: Zone 'netly.io' (/etc/powerdns/bind/netly.io.) needs reloading
Sep 30 22:21:28 node-e31401 pdns[2259]: Zone 'netly.io' (/etc/powerdns/bind/netly.io.) reloaded
However, when I entirely restart PDNS it finally figures out it is outdated and correctly fetches the updated zone:
slave-server # /etc/init.d/pdns restart
[ ok ] Restarting PowerDNS Authoritative Name Server: pdns.
slave-server # tail -f /var/log/daemon.log
Sep 30 22:23:48 node-e31401 pdns[2911]: 2 slave domains need checking, 0 queued for AXFR
Sep 30 22:23:48 node-e31401 pdns[2911]: Received serial number updates for 2 zones, had 0 timeouts
Sep 30 22:23:48 node-e31401 pdns[2911]: Domain netly.io is stale, master serial 2013093004, our serial 2013093003
Sep 30 22:23:48 node-e31401 pdns[2911]: Domain titify.com is fresh (not presigned, no RRSIG check)
Sep 30 22:23:48 node-e31401 pdns[2911]: No master domains need notifications
Sep 30 22:23:48 node-e31401 pdns[2911]: Initiating transfer of 'netly.io' from remote '146.185.146.149'
Sep 30 22:23:48 node-e31401 pdns[2911]: AXFR started for 'netly.io', transaction started
Sep 30 22:23:48 node-e31401 pdns[2911]: Zone 'netly.io' (/etc/powerdns/bind/netly.io.) reloaded
Sep 30 22:23:48 node-e31401 pdns[2911]: AXFR done for 'netly.io', zone committed with serial number 2013093004
Sep 30 22:23:48 node-e31401 pdns[2911]: Done launching threads, ready to distribute questions
What am I missing here? What is causing the master to correctly notify the slave, but the slave not to fetch the new zone?
Edit:
- Slave config: https://static.0x04.com/2013/10/slave.pdns_.txt
- Master config: https://static.0x04.com/2013/10/master.pdns_.txt
tcpdump:
node-fd1d01 ~ # tcpdump -n 'host 146.185.146.149 and port 53'
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
09:51:38.042713 IP 146.185.146.149.42478 > 162.243.29.199.53: 61745 notify [b2&3=0x2400] SOA? netly.io. (26)
09:51:41.043323 IP 146.185.146.149.42478 > 162.243.29.199.53: 61745 notify [b2&3=0x2400] SOA? netly.io. (26)
09:51:46.044145 IP 146.185.146.149.42478 > 162.243.29.199.53: 61745 notify [b2&3=0x2400] SOA? netly.io. (26)
09:51:52.049533 IP 146.185.146.149.42478 > 162.243.29.199.53: 59408 notify [b2&3=0x2400] SOA? netly.io. (26)
09:51:55.050715 IP 146.185.146.149.42478 > 162.243.29.199.53: 61745 notify [b2&3=0x2400] SOA? netly.io. (26)
09:51:55.050753 IP 146.185.146.149.42478 > 162.243.29.199.53: 59408 notify [b2&3=0x2400] SOA? netly.io. (26)
09:52:00.053327 IP 146.185.146.149.42478 > 162.243.29.199.53: 59408 notify [b2&3=0x2400] SOA? netly.io. (26)
09:52:09.056321 IP 146.185.146.149.42478 > 162.243.29.199.53: 59408 notify [b2&3=0x2400] SOA? netly.io. (26)
Log doesn't show anything new (latest at 09h48):
node-fd1d01 /etc/powerdns/bind # tail -f /var/log/daemon.log
Oct 2 09:47:59 localhost pdns[2253]: Domain netly.io is fresh (not presigned, no RRSIG check)
Oct 2 09:47:59 localhost pdns[2253]: Domain titify.com is fresh (not presigned, no RRSIG check)
Oct 2 09:47:59 localhost pdns[2253]: No master domains need notifications
Oct 2 09:47:59 localhost pdns[2253]: Done launching threads, ready to distribute questions
Oct 2 09:48:00 localhost ntpd[2144]: Listen normally on 6 tun0 172.17.24.1 UDP 123
Oct 2 09:48:00 localhost ntpd[2144]: Listen normally on 7 tun1 172.17.16.1 UDP 123
Oct 2 09:48:00 localhost ntpd[2144]: peers refreshed
Oct 2 09:48:12 localhost dbus[2093]: [system] Activating service name='org.freedesktop.ConsoleKit' (using servicehelper)
Oct 2 09:48:12 localhost dbus[2093]: [system] Successfully activated service 'org.freedesktop.ConsoleKit'
Oct 2 09:48:59 localhost pdns[2253]: No new unfresh slave domains, 0 queued for AXFR already
But when I cat the zone file (in Bind format) it's not updated.
powerdns
asked Sep 30 '13 at 22:26
TuinslakTuinslak
87272146
I'm running two machines with PowerDNS, one being the master (SQL) and one being the slave (Bind backend).
After I modify a domain and bump the serial, I get this in the log:
Sep 30 22:13:20 localhost pdns[6884]: 1 domain for which we are master needs notifications
Sep 30 22:13:20 localhost pdns[6884]: Queued notification of domain 'netly.io' to 146.185.146.149
Sep 30 22:13:20 localhost pdns[6884]: Queued notification of domain 'netly.io' to 146.185.147.74
Sep 30 22:13:20 localhost pdns[6884]: Received NOTIFY for netly.io from 146.185.146.149 but slave support is disabled in the configuration
Sep 30 22:13:21 localhost pdns[6884]: Received unsuccessful notification report for 'netly.io' from 146.185.146.149:53, rcode: 4
Sep 30 22:13:21 localhost pdns[6884]: Removed from notification list: 'netly.io' to 146.185.146.149:53
Sep 30 22:13:23 localhost pdns[6884]: No master domains need notifications
I understand it's notifying itself (146.185.146.149) because it is set as nameserver, and that those errors can be ignored.
It (looks like) notifies the other server (146.185.147.74 or 162.243.29.199) as well.
However, the slave doesn't show anything in the log around that time frame, and when I cat the domain file, I can see the old serial and the subdomain not being updated.
dig @slave-server also shows the old settings.
telling it to reload also doesn't update the bind zone file:
slave-server # pdns_control reload
Ok
slave-server # tail -f /var/log/daemon.log
Sep 30 22:21:28 node-e31401 pdns[2259]: Zone 'netly.io' (/etc/powerdns/bind/netly.io.) needs reloading
Sep 30 22:21:28 node-e31401 pdns[2259]: Zone 'netly.io' (/etc/powerdns/bind/netly.io.) reloaded
However, when I entirely restart PDNS it finally figures out it is outdated and correctly fetches the updated zone:
slave-server # /etc/init.d/pdns restart
[ ok ] Restarting PowerDNS Authoritative Name Server: pdns.
slave-server # tail -f /var/log/daemon.log
Sep 30 22:23:48 node-e31401 pdns[2911]: 2 slave domains need checking, 0 queued for AXFR
Sep 30 22:23:48 node-e31401 pdns[2911]: Received serial number updates for 2 zones, had 0 timeouts
Sep 30 22:23:48 node-e31401 pdns[2911]: Domain netly.io is stale, master serial 2013093004, our serial 2013093003
Sep 30 22:23:48 node-e31401 pdns[2911]: Domain titify.com is fresh (not presigned, no RRSIG check)
Sep 30 22:23:48 node-e31401 pdns[2911]: No master domains need notifications
Sep 30 22:23:48 node-e31401 pdns[2911]: Initiating transfer of 'netly.io' from remote '146.185.146.149'
Sep 30 22:23:48 node-e31401 pdns[2911]: AXFR started for 'netly.io', transaction started
Sep 30 22:23:48 node-e31401 pdns[2911]: Zone 'netly.io' (/etc/powerdns/bind/netly.io.) reloaded
Sep 30 22:23:48 node-e31401 pdns[2911]: AXFR done for 'netly.io', zone committed with serial number 2013093004
Sep 30 22:23:48 node-e31401 pdns[2911]: Done launching threads, ready to distribute questions
What am I missing here? What is causing the master to correctly notify the slave, but the slave not to fetch the new zone?
Edit:
- Slave config: https://static.0x04.com/2013/10/slave.pdns_.txt
- Master config: https://static.0x04.com/2013/10/master.pdns_.txt
tcpdump:
node-fd1d01 ~ # tcpdump -n 'host 146.185.146.149 and port 53'
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
09:51:38.042713 IP 146.185.146.149.42478 > 162.243.29.199.53: 61745 notify [b2&3=0x2400] SOA? netly.io. (26)
09:51:41.043323 IP 146.185.146.149.42478 > 162.243.29.199.53: 61745 notify [b2&3=0x2400] SOA? netly.io. (26)
09:51:46.044145 IP 146.185.146.149.42478 > 162.243.29.199.53: 61745 notify [b2&3=0x2400] SOA? netly.io. (26)
09:51:52.049533 IP 146.185.146.149.42478 > 162.243.29.199.53: 59408 notify [b2&3=0x2400] SOA? netly.io. (26)
09:51:55.050715 IP 146.185.146.149.42478 > 162.243.29.199.53: 61745 notify [b2&3=0x2400] SOA? netly.io. (26)
09:51:55.050753 IP 146.185.146.149.42478 > 162.243.29.199.53: 59408 notify [b2&3=0x2400] SOA? netly.io. (26)
09:52:00.053327 IP 146.185.146.149.42478 > 162.243.29.199.53: 59408 notify [b2&3=0x2400] SOA? netly.io. (26)
09:52:09.056321 IP 146.185.146.149.42478 > 162.243.29.199.53: 59408 notify [b2&3=0x2400] SOA? netly.io. (26)
Log doesn't show anything new (latest at 09h48):
node-fd1d01 /etc/powerdns/bind # tail -f /var/log/daemon.log
Oct 2 09:47:59 localhost pdns[2253]: Domain netly.io is fresh (not presigned, no RRSIG check)
Oct 2 09:47:59 localhost pdns[2253]: Domain titify.com is fresh (not presigned, no RRSIG check)
Oct 2 09:47:59 localhost pdns[2253]: No master domains need notifications
Oct 2 09:47:59 localhost pdns[2253]: Done launching threads, ready to distribute questions
Oct 2 09:48:00 localhost ntpd[2144]: Listen normally on 6 tun0 172.17.24.1 UDP 123
Oct 2 09:48:00 localhost ntpd[2144]: Listen normally on 7 tun1 172.17.16.1 UDP 123
Oct 2 09:48:00 localhost ntpd[2144]: peers refreshed
Oct 2 09:48:12 localhost dbus[2093]: [system] Activating service name='org.freedesktop.ConsoleKit' (using servicehelper)
Oct 2 09:48:12 localhost dbus[2093]: [system] Successfully activated service 'org.freedesktop.ConsoleKit'
Oct 2 09:48:59 localhost pdns[2253]: No new unfresh slave domains, 0 queued for AXFR already
But when I cat the zone file (in Bind format) it's not updated.
powerdns
powerdns
asked Sep 30 '13 at 22:26
TuinslakTuinslak
87272146
asked Sep 30 '13 at 22:26
TuinslakTuinslak
87272146
edited Oct 2 '13 at 9:55
Tuinslak
asked Sep 30 '13 at 22:26
TuinslakTuinslak
87272146
asked Sep 30 '13 at 22:26
TuinslakTuinslak
87272146
asked Sep 30 '13 at 22:26
TuinslakTuinslak
87272146
87272146
The initial post got updated with the configs.
– Tuinslak
Oct 1 '13 at 18:21
Make sure the notify from master to slave isn't blocked by any firewall.
– Stefan
Oct 2 '13 at 7:34
TCP/53, right? Those ports are open.
– Tuinslak
Oct 2 '13 at 7:56
1
Notify uses UDP/53 (master: random port, slave: port 53). you could watch withtcpdump -n 'host 146.185.146.149 and port 53'on your slave, and triggerpdns_control notify netly.ioon the master.
– Stefan
Oct 2 '13 at 8:28
1
Your secondaries (*.titify.com) seem to be entirely unreachable from the Internet. Not sure this is causing your problem, but it certainly doesn't help. Also makes it hard to debug from the outside.
– Habbie
Oct 3 '13 at 10:07
|
show 3 more comments
The initial post got updated with the configs.
– Tuinslak
Oct 1 '13 at 18:21
Make sure the notify from master to slave isn't blocked by any firewall.
– Stefan
Oct 2 '13 at 7:34
TCP/53, right? Those ports are open.
– Tuinslak
Oct 2 '13 at 7:56
1
Notify uses UDP/53 (master: random port, slave: port 53). you could watch withtcpdump -n 'host 146.185.146.149 and port 53'on your slave, and triggerpdns_control notify netly.ioon the master.
– Stefan
Oct 2 '13 at 8:28
1
Your secondaries (*.titify.com) seem to be entirely unreachable from the Internet. Not sure this is causing your problem, but it certainly doesn't help. Also makes it hard to debug from the outside.
– Habbie
Oct 3 '13 at 10:07
The initial post got updated with the configs.
– Tuinslak
Oct 1 '13 at 18:21
The initial post got updated with the configs.
– Tuinslak
Oct 1 '13 at 18:21
Make sure the notify from master to slave isn't blocked by any firewall.
– Stefan
Oct 2 '13 at 7:34
Make sure the notify from master to slave isn't blocked by any firewall.
– Stefan
Oct 2 '13 at 7:34
TCP/53, right? Those ports are open.
– Tuinslak
Oct 2 '13 at 7:56
TCP/53, right? Those ports are open.
– Tuinslak
Oct 2 '13 at 7:56
1
1
Notify uses UDP/53 (master: random port, slave: port 53). you could watch with
tcpdump -n 'host 146.185.146.149 and port 53' on your slave, and trigger pdns_control notify netly.io on the master.– Stefan
Oct 2 '13 at 8:28
Notify uses UDP/53 (master: random port, slave: port 53). you could watch with
tcpdump -n 'host 146.185.146.149 and port 53' on your slave, and trigger pdns_control notify netly.io on the master.– Stefan
Oct 2 '13 at 8:28
1
1
Your secondaries (*.titify.com) seem to be entirely unreachable from the Internet. Not sure this is causing your problem, but it certainly doesn't help. Also makes it hard to debug from the outside.
– Habbie
Oct 3 '13 at 10:07
Your secondaries (*.titify.com) seem to be entirely unreachable from the Internet. Not sure this is causing your problem, but it certainly doesn't help. Also makes it hard to debug from the outside.
– Habbie
Oct 3 '13 at 10:07
|
show 3 more comments
3 Answers
3
active
oldest
votes
2
We were experiencing this and it turns out that the target of the DNS notification message was actually refusing the message.
Notice the "notify Refused" below. Substituted fake server and zone names.
# tcpdump -v -r notify.pcap
reading from file notify.pcap, link-type LINUX_SLL (Linux cooked)
00:00:33.210137 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto UDP (17), length 61) master.dns.server.46861 > slave.dns.server.domain: 49437 notify SOA? zoneinquestion.com. (33)
00:00:33.236488 IP (tos 0x0, ttl 55, id 17352, offset 0, flags [none], proto UDP (17), length 61) slave.dns.server.domain > master.dns.server.46861: 49437 notify Refused- 0/0/0 (33)
00:00:36.244057 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto UDP (17), length 61) master.dns.server.46861 > slave.dns.server.domain: 48449 notify SOA? zoneinquestion.com. (33)
00:00:36.269682 IP (tos 0x0, ttl 55, id 17353, offset 0, flags [none], proto UDP (17), length 61) slave.dns.server.domain > master.dns.server.46861: 48449 notify Refused- 0/0/0 (33)
00:00:36.519361 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto UDP (17), length 61) master.dns.server.46861 > slave.dns.server.domain: 65128 notify SOA? zoneinquestion.com. (33)
00:00:36.544391 IP (tos 0x0, ttl 55, id 17354, offset 0, flags [none], proto UDP (17), length 61) slave.dns.server.domain > master.dns.server.46861: 65128 notify Refused- 0/0/0 (33)
Captured this output on the master with the following:
tcpdump -U -i any -w notify.pcap -s 1600 host slave.dns.server
answered Mar 11 '15 at 1:40
lance.johnsnlance.johnsn
1213
add a comment |
1
The problem was port 53 being firewalled from the outside port, but not on the localhost or on the VPN interface.
I hadn't noticed because I usually tried dig @localhost.
If I understand correctly, master sends a message to UDP/53 (via Stefan). This was thus partially firewalled and caused the problem.
Master:
Oct 3 18:56:25 localhost pdns[6884]: gmysql Connection successful
Oct 3 18:56:25 localhost pdns[6884]: AXFR of domain 'netly.io' initiated by 162.243.25.159
Oct 3 18:56:25 localhost pdns[6884]: AXFR of domain 'netly.io' allowed: client IP 162.243.25.159 is in allow-axfr-ips
Oct 3 18:56:25 localhost pdns[6884]: gmysql Connection successful
Oct 3 18:56:25 localhost pdns[6884]: gmysql Connection successful
Oct 3 18:56:25 localhost pdns[6884]: AXFR of domain 'netly.io' to 162.243.25.159 finished
Oct 3 18:56:25 localhost pdns[6884]: Received unsuccessful notification report for 'netly.io' from 146.185.146.149:53, rcode: 4
Oct 3 18:56:25 localhost pdns[6884]: Removed from notification list: 'netly.io' to 146.185.146.149:53
Oct 3 18:56:25 localhost pdns[6884]: Removed from notification list: 'netly.io' to 162.243.25.159:53 (was acknowledged)
Oct 3 18:56:27 localhost pdns[6884]: No master domains need notifications
Slave:
Oct 3 18:56:25 localhost pdns[2263]: 1 slave domain needs checking, 0 queued for AXFR
Oct 3 18:56:25 localhost pdns[2263]: Received serial number updates for 1 zones, had 0 timeouts
Oct 3 18:56:25 localhost pdns[2263]: Domain netly.io is stale, master serial 2013100302, our serial 2013100301
Oct 3 18:56:25 localhost pdns[2263]: Initiating transfer of 'netly.io' from remote '146.185.146.149'
Oct 3 18:56:25 localhost pdns[2263]: AXFR started for 'netly.io', transaction started
Oct 3 18:56:25 localhost pdns[2263]: Zone 'netly.io' (/etc/powerdns/bind/netly.io.) reloaded
Oct 3 18:56:25 localhost pdns[2263]: AXFR done for 'netly.io', zone committed with serial number 2013100302
answered Oct 3 '13 at 19:01
TuinslakTuinslak
87272146
add a comment |
0
don't forget to increase your serial. a AXFR notify does nothing if you haven't increased the serial on the master
answered Apr 8 at 12:38
c33sc33s
70231434
add a comment |
Your Answer
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "2"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
draft saved
draft discarded
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f542806%2fpowerdns-slaves-not-updating-after-being-notified%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
3 Answers
3
active
oldest
votes
3 Answers
3
active
oldest
votes
active
oldest
votes
active
oldest
votes
2
We were experiencing this and it turns out that the target of the DNS notification message was actually refusing the message.
Notice the "notify Refused" below. Substituted fake server and zone names.
# tcpdump -v -r notify.pcap
reading from file notify.pcap, link-type LINUX_SLL (Linux cooked)
00:00:33.210137 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto UDP (17), length 61) master.dns.server.46861 > slave.dns.server.domain: 49437 notify SOA? zoneinquestion.com. (33)
00:00:33.236488 IP (tos 0x0, ttl 55, id 17352, offset 0, flags [none], proto UDP (17), length 61) slave.dns.server.domain > master.dns.server.46861: 49437 notify Refused- 0/0/0 (33)
00:00:36.244057 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto UDP (17), length 61) master.dns.server.46861 > slave.dns.server.domain: 48449 notify SOA? zoneinquestion.com. (33)
00:00:36.269682 IP (tos 0x0, ttl 55, id 17353, offset 0, flags [none], proto UDP (17), length 61) slave.dns.server.domain > master.dns.server.46861: 48449 notify Refused- 0/0/0 (33)
00:00:36.519361 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto UDP (17), length 61) master.dns.server.46861 > slave.dns.server.domain: 65128 notify SOA? zoneinquestion.com. (33)
00:00:36.544391 IP (tos 0x0, ttl 55, id 17354, offset 0, flags [none], proto UDP (17), length 61) slave.dns.server.domain > master.dns.server.46861: 65128 notify Refused- 0/0/0 (33)
Captured this output on the master with the following:
tcpdump -U -i any -w notify.pcap -s 1600 host slave.dns.server
answered Mar 11 '15 at 1:40
lance.johnsnlance.johnsn
1213
add a comment |
2
We were experiencing this and it turns out that the target of the DNS notification message was actually refusing the message.
Notice the "notify Refused" below. Substituted fake server and zone names.
# tcpdump -v -r notify.pcap
reading from file notify.pcap, link-type LINUX_SLL (Linux cooked)
00:00:33.210137 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto UDP (17), length 61) master.dns.server.46861 > slave.dns.server.domain: 49437 notify SOA? zoneinquestion.com. (33)
00:00:33.236488 IP (tos 0x0, ttl 55, id 17352, offset 0, flags [none], proto UDP (17), length 61) slave.dns.server.domain > master.dns.server.46861: 49437 notify Refused- 0/0/0 (33)
00:00:36.244057 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto UDP (17), length 61) master.dns.server.46861 > slave.dns.server.domain: 48449 notify SOA? zoneinquestion.com. (33)
00:00:36.269682 IP (tos 0x0, ttl 55, id 17353, offset 0, flags [none], proto UDP (17), length 61) slave.dns.server.domain > master.dns.server.46861: 48449 notify Refused- 0/0/0 (33)
00:00:36.519361 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto UDP (17), length 61) master.dns.server.46861 > slave.dns.server.domain: 65128 notify SOA? zoneinquestion.com. (33)
00:00:36.544391 IP (tos 0x0, ttl 55, id 17354, offset 0, flags [none], proto UDP (17), length 61) slave.dns.server.domain > master.dns.server.46861: 65128 notify Refused- 0/0/0 (33)
Captured this output on the master with the following:
tcpdump -U -i any -w notify.pcap -s 1600 host slave.dns.server
answered Mar 11 '15 at 1:40
lance.johnsnlance.johnsn
1213
add a comment |
2
2
2
We were experiencing this and it turns out that the target of the DNS notification message was actually refusing the message.
Notice the "notify Refused" below. Substituted fake server and zone names.
# tcpdump -v -r notify.pcap
reading from file notify.pcap, link-type LINUX_SLL (Linux cooked)
00:00:33.210137 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto UDP (17), length 61) master.dns.server.46861 > slave.dns.server.domain: 49437 notify SOA? zoneinquestion.com. (33)
00:00:33.236488 IP (tos 0x0, ttl 55, id 17352, offset 0, flags [none], proto UDP (17), length 61) slave.dns.server.domain > master.dns.server.46861: 49437 notify Refused- 0/0/0 (33)
00:00:36.244057 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto UDP (17), length 61) master.dns.server.46861 > slave.dns.server.domain: 48449 notify SOA? zoneinquestion.com. (33)
00:00:36.269682 IP (tos 0x0, ttl 55, id 17353, offset 0, flags [none], proto UDP (17), length 61) slave.dns.server.domain > master.dns.server.46861: 48449 notify Refused- 0/0/0 (33)
00:00:36.519361 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto UDP (17), length 61) master.dns.server.46861 > slave.dns.server.domain: 65128 notify SOA? zoneinquestion.com. (33)
00:00:36.544391 IP (tos 0x0, ttl 55, id 17354, offset 0, flags [none], proto UDP (17), length 61) slave.dns.server.domain > master.dns.server.46861: 65128 notify Refused- 0/0/0 (33)
Captured this output on the master with the following:
tcpdump -U -i any -w notify.pcap -s 1600 host slave.dns.server
answered Mar 11 '15 at 1:40
lance.johnsnlance.johnsn
1213
We were experiencing this and it turns out that the target of the DNS notification message was actually refusing the message.
Notice the "notify Refused" below. Substituted fake server and zone names.
# tcpdump -v -r notify.pcap
reading from file notify.pcap, link-type LINUX_SLL (Linux cooked)
00:00:33.210137 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto UDP (17), length 61) master.dns.server.46861 > slave.dns.server.domain: 49437 notify SOA? zoneinquestion.com. (33)
00:00:33.236488 IP (tos 0x0, ttl 55, id 17352, offset 0, flags [none], proto UDP (17), length 61) slave.dns.server.domain > master.dns.server.46861: 49437 notify Refused- 0/0/0 (33)
00:00:36.244057 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto UDP (17), length 61) master.dns.server.46861 > slave.dns.server.domain: 48449 notify SOA? zoneinquestion.com. (33)
00:00:36.269682 IP (tos 0x0, ttl 55, id 17353, offset 0, flags [none], proto UDP (17), length 61) slave.dns.server.domain > master.dns.server.46861: 48449 notify Refused- 0/0/0 (33)
00:00:36.519361 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto UDP (17), length 61) master.dns.server.46861 > slave.dns.server.domain: 65128 notify SOA? zoneinquestion.com. (33)
00:00:36.544391 IP (tos 0x0, ttl 55, id 17354, offset 0, flags [none], proto UDP (17), length 61) slave.dns.server.domain > master.dns.server.46861: 65128 notify Refused- 0/0/0 (33)
Captured this output on the master with the following:
tcpdump -U -i any -w notify.pcap -s 1600 host slave.dns.server
answered Mar 11 '15 at 1:40
lance.johnsnlance.johnsn
1213
answered Mar 11 '15 at 1:40
lance.johnsnlance.johnsn
1213
answered Mar 11 '15 at 1:40
lance.johnsnlance.johnsn
1213
answered Mar 11 '15 at 1:40
lance.johnsnlance.johnsn
1213
1213
add a comment |
add a comment |
1
The problem was port 53 being firewalled from the outside port, but not on the localhost or on the VPN interface.
I hadn't noticed because I usually tried dig @localhost.
If I understand correctly, master sends a message to UDP/53 (via Stefan). This was thus partially firewalled and caused the problem.
Master:
Oct 3 18:56:25 localhost pdns[6884]: gmysql Connection successful
Oct 3 18:56:25 localhost pdns[6884]: AXFR of domain 'netly.io' initiated by 162.243.25.159
Oct 3 18:56:25 localhost pdns[6884]: AXFR of domain 'netly.io' allowed: client IP 162.243.25.159 is in allow-axfr-ips
Oct 3 18:56:25 localhost pdns[6884]: gmysql Connection successful
Oct 3 18:56:25 localhost pdns[6884]: gmysql Connection successful
Oct 3 18:56:25 localhost pdns[6884]: AXFR of domain 'netly.io' to 162.243.25.159 finished
Oct 3 18:56:25 localhost pdns[6884]: Received unsuccessful notification report for 'netly.io' from 146.185.146.149:53, rcode: 4
Oct 3 18:56:25 localhost pdns[6884]: Removed from notification list: 'netly.io' to 146.185.146.149:53
Oct 3 18:56:25 localhost pdns[6884]: Removed from notification list: 'netly.io' to 162.243.25.159:53 (was acknowledged)
Oct 3 18:56:27 localhost pdns[6884]: No master domains need notifications
Slave:
Oct 3 18:56:25 localhost pdns[2263]: 1 slave domain needs checking, 0 queued for AXFR
Oct 3 18:56:25 localhost pdns[2263]: Received serial number updates for 1 zones, had 0 timeouts
Oct 3 18:56:25 localhost pdns[2263]: Domain netly.io is stale, master serial 2013100302, our serial 2013100301
Oct 3 18:56:25 localhost pdns[2263]: Initiating transfer of 'netly.io' from remote '146.185.146.149'
Oct 3 18:56:25 localhost pdns[2263]: AXFR started for 'netly.io', transaction started
Oct 3 18:56:25 localhost pdns[2263]: Zone 'netly.io' (/etc/powerdns/bind/netly.io.) reloaded
Oct 3 18:56:25 localhost pdns[2263]: AXFR done for 'netly.io', zone committed with serial number 2013100302
answered Oct 3 '13 at 19:01
TuinslakTuinslak
87272146
add a comment |
1
The problem was port 53 being firewalled from the outside port, but not on the localhost or on the VPN interface.
I hadn't noticed because I usually tried dig @localhost.
If I understand correctly, master sends a message to UDP/53 (via Stefan). This was thus partially firewalled and caused the problem.
Master:
Oct 3 18:56:25 localhost pdns[6884]: gmysql Connection successful
Oct 3 18:56:25 localhost pdns[6884]: AXFR of domain 'netly.io' initiated by 162.243.25.159
Oct 3 18:56:25 localhost pdns[6884]: AXFR of domain 'netly.io' allowed: client IP 162.243.25.159 is in allow-axfr-ips
Oct 3 18:56:25 localhost pdns[6884]: gmysql Connection successful
Oct 3 18:56:25 localhost pdns[6884]: gmysql Connection successful
Oct 3 18:56:25 localhost pdns[6884]: AXFR of domain 'netly.io' to 162.243.25.159 finished
Oct 3 18:56:25 localhost pdns[6884]: Received unsuccessful notification report for 'netly.io' from 146.185.146.149:53, rcode: 4
Oct 3 18:56:25 localhost pdns[6884]: Removed from notification list: 'netly.io' to 146.185.146.149:53
Oct 3 18:56:25 localhost pdns[6884]: Removed from notification list: 'netly.io' to 162.243.25.159:53 (was acknowledged)
Oct 3 18:56:27 localhost pdns[6884]: No master domains need notifications
Slave:
Oct 3 18:56:25 localhost pdns[2263]: 1 slave domain needs checking, 0 queued for AXFR
Oct 3 18:56:25 localhost pdns[2263]: Received serial number updates for 1 zones, had 0 timeouts
Oct 3 18:56:25 localhost pdns[2263]: Domain netly.io is stale, master serial 2013100302, our serial 2013100301
Oct 3 18:56:25 localhost pdns[2263]: Initiating transfer of 'netly.io' from remote '146.185.146.149'
Oct 3 18:56:25 localhost pdns[2263]: AXFR started for 'netly.io', transaction started
Oct 3 18:56:25 localhost pdns[2263]: Zone 'netly.io' (/etc/powerdns/bind/netly.io.) reloaded
Oct 3 18:56:25 localhost pdns[2263]: AXFR done for 'netly.io', zone committed with serial number 2013100302
answered Oct 3 '13 at 19:01
TuinslakTuinslak
87272146
add a comment |
1
1
1
The problem was port 53 being firewalled from the outside port, but not on the localhost or on the VPN interface.
I hadn't noticed because I usually tried dig @localhost.
If I understand correctly, master sends a message to UDP/53 (via Stefan). This was thus partially firewalled and caused the problem.
Master:
Oct 3 18:56:25 localhost pdns[6884]: gmysql Connection successful
Oct 3 18:56:25 localhost pdns[6884]: AXFR of domain 'netly.io' initiated by 162.243.25.159
Oct 3 18:56:25 localhost pdns[6884]: AXFR of domain 'netly.io' allowed: client IP 162.243.25.159 is in allow-axfr-ips
Oct 3 18:56:25 localhost pdns[6884]: gmysql Connection successful
Oct 3 18:56:25 localhost pdns[6884]: gmysql Connection successful
Oct 3 18:56:25 localhost pdns[6884]: AXFR of domain 'netly.io' to 162.243.25.159 finished
Oct 3 18:56:25 localhost pdns[6884]: Received unsuccessful notification report for 'netly.io' from 146.185.146.149:53, rcode: 4
Oct 3 18:56:25 localhost pdns[6884]: Removed from notification list: 'netly.io' to 146.185.146.149:53
Oct 3 18:56:25 localhost pdns[6884]: Removed from notification list: 'netly.io' to 162.243.25.159:53 (was acknowledged)
Oct 3 18:56:27 localhost pdns[6884]: No master domains need notifications
Slave:
Oct 3 18:56:25 localhost pdns[2263]: 1 slave domain needs checking, 0 queued for AXFR
Oct 3 18:56:25 localhost pdns[2263]: Received serial number updates for 1 zones, had 0 timeouts
Oct 3 18:56:25 localhost pdns[2263]: Domain netly.io is stale, master serial 2013100302, our serial 2013100301
Oct 3 18:56:25 localhost pdns[2263]: Initiating transfer of 'netly.io' from remote '146.185.146.149'
Oct 3 18:56:25 localhost pdns[2263]: AXFR started for 'netly.io', transaction started
Oct 3 18:56:25 localhost pdns[2263]: Zone 'netly.io' (/etc/powerdns/bind/netly.io.) reloaded
Oct 3 18:56:25 localhost pdns[2263]: AXFR done for 'netly.io', zone committed with serial number 2013100302
answered Oct 3 '13 at 19:01
TuinslakTuinslak
87272146
The problem was port 53 being firewalled from the outside port, but not on the localhost or on the VPN interface.
I hadn't noticed because I usually tried dig @localhost.
If I understand correctly, master sends a message to UDP/53 (via Stefan). This was thus partially firewalled and caused the problem.
Master:
Oct 3 18:56:25 localhost pdns[6884]: gmysql Connection successful
Oct 3 18:56:25 localhost pdns[6884]: AXFR of domain 'netly.io' initiated by 162.243.25.159
Oct 3 18:56:25 localhost pdns[6884]: AXFR of domain 'netly.io' allowed: client IP 162.243.25.159 is in allow-axfr-ips
Oct 3 18:56:25 localhost pdns[6884]: gmysql Connection successful
Oct 3 18:56:25 localhost pdns[6884]: gmysql Connection successful
Oct 3 18:56:25 localhost pdns[6884]: AXFR of domain 'netly.io' to 162.243.25.159 finished
Oct 3 18:56:25 localhost pdns[6884]: Received unsuccessful notification report for 'netly.io' from 146.185.146.149:53, rcode: 4
Oct 3 18:56:25 localhost pdns[6884]: Removed from notification list: 'netly.io' to 146.185.146.149:53
Oct 3 18:56:25 localhost pdns[6884]: Removed from notification list: 'netly.io' to 162.243.25.159:53 (was acknowledged)
Oct 3 18:56:27 localhost pdns[6884]: No master domains need notifications
Slave:
Oct 3 18:56:25 localhost pdns[2263]: 1 slave domain needs checking, 0 queued for AXFR
Oct 3 18:56:25 localhost pdns[2263]: Received serial number updates for 1 zones, had 0 timeouts
Oct 3 18:56:25 localhost pdns[2263]: Domain netly.io is stale, master serial 2013100302, our serial 2013100301
Oct 3 18:56:25 localhost pdns[2263]: Initiating transfer of 'netly.io' from remote '146.185.146.149'
Oct 3 18:56:25 localhost pdns[2263]: AXFR started for 'netly.io', transaction started
Oct 3 18:56:25 localhost pdns[2263]: Zone 'netly.io' (/etc/powerdns/bind/netly.io.) reloaded
Oct 3 18:56:25 localhost pdns[2263]: AXFR done for 'netly.io', zone committed with serial number 2013100302
answered Oct 3 '13 at 19:01
TuinslakTuinslak
87272146
answered Oct 3 '13 at 19:01
TuinslakTuinslak
87272146
answered Oct 3 '13 at 19:01
TuinslakTuinslak
87272146
answered Oct 3 '13 at 19:01
TuinslakTuinslak
87272146
87272146
add a comment |
add a comment |
0
don't forget to increase your serial. a AXFR notify does nothing if you haven't increased the serial on the master
answered Apr 8 at 12:38
c33sc33s
70231434
add a comment |
0
don't forget to increase your serial. a AXFR notify does nothing if you haven't increased the serial on the master
answered Apr 8 at 12:38
c33sc33s
70231434
add a comment |
0
0
0
don't forget to increase your serial. a AXFR notify does nothing if you haven't increased the serial on the master
answered Apr 8 at 12:38
c33sc33s
70231434
don't forget to increase your serial. a AXFR notify does nothing if you haven't increased the serial on the master
answered Apr 8 at 12:38
c33sc33s
70231434
answered Apr 8 at 12:38
c33sc33s
70231434
answered Apr 8 at 12:38
c33sc33s
70231434
answered Apr 8 at 12:38
c33sc33s
70231434
70231434
add a comment |
add a comment |
draft saved
draft discarded
Thanks for contributing an answer to Server Fault!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
draft saved
draft discarded
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f542806%2fpowerdns-slaves-not-updating-after-being-notified%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
The initial post got updated with the configs.
– Tuinslak
Oct 1 '13 at 18:21
Make sure the notify from master to slave isn't blocked by any firewall.
– Stefan
Oct 2 '13 at 7:34
TCP/53, right? Those ports are open.
– Tuinslak
Oct 2 '13 at 7:56
1
Notify uses UDP/53 (master: random port, slave: port 53). you could watch with
tcpdump -n 'host 146.185.146.149 and port 53'on your slave, and triggerpdns_control notify netly.ioon the master.– Stefan
Oct 2 '13 at 8:28
1
Your secondaries (*.titify.com) seem to be entirely unreachable from the Internet. Not sure this is causing your problem, but it certainly doesn't help. Also makes it hard to debug from the outside.
– Habbie
Oct 3 '13 at 10:07