I've been increasingly using the PowerDNS Recursor (pdns_recursor), and I've been pretty happy with it. I've been testing it for something close to 2 years now, and have really had no problems with it. Initially using it as a caching DNS server on my laptop, then putting it in place as a backup recursor for our hosting. A week or so ago we completed setting up it up on a HA load-balancing cluster as our primary recursor.

As part of that setup, I set up munin to graph some usage and performance stats. Read below for more information and links to these plugins.

Munin is a great system for doing utilization graphing and capacity analysis and planning. One of it's nicest features is a rich set of auto-configuring plugins. Once you have your system installed as you like it, install munin and it'll figure out what you are running that it can graph, and start graphing it.

These plugins are fairly simple shell scripts.

I've created a set of Munin plugins for pdns_recursor which can be downloaded at ftp://ftp.tummy.com/pub/tummy/munin-pdns_recursor/.

See the README for installation information, but basically you just have to:

• Put the pdns_rec_* files in /etc/munin/plugins
• chmod 755 /etc/munin/plugins/pdns_rec_*
• Set up the plugins to run as root rather than "munin", see the README of the comments in the plugins on how to do this.
• Restart the munin-node daemon.

Within around 10 minutes you should start seeing pretty graphs.

We found a few interesting things after we started getting this information:

• One of our customer machines is doing dozens of queries per second for "twitter.com". This was made worse because their resolv.conf had a bogus "search" directive in it, causing it to do twice as many queries. Still, that one box is doing a huge number of queries for this one name. Not a huge deal, because they all get served out of our cache.
• Another customer machine, every other hour for around an hour, does around 50 queries/sec. This seems to be log analysis which includes converting IP addresses to names.
• Our recursive and authoritative DNS servers average around T1s worth of bandwidth (200KB/sec).
• During the day DNS is using nearly 2 T1s worth of bandwidth.

Ah, I remember the good old days when a T1 was a big Internet pipe. :-)
(Post Reply)