Nameservers stop responding and sites go offline

[Mike H]

Hi, I have a webmin/virtualmin setup with one website on. Every few days (it's random) the webites will drop offline due to NS records not working, and webmin also drops offline unless accesed via IP.

Logging into SSH and restarting named service resolves the issue.

Short of restarting the named service on a cron, has anyone any ideas at all? This is impacting live sites frequently.

Thanks

[Ilia]

Mike, hi,

At first make sure that you have installed all latest updates and rebooted your server (it's a good thing to to sometimes, especially, if things go wrong). Then check logs for errors and Google the problem.

Aside from the bug, probably you don't have enough RAM?

[Mike H]

Thanks for the reply. It's fully patched, and is a VPS provisioned a month ago. It gets rebooted weekly also. It has 16GB ram and only one small website is hosted on it. I've not found anything in logs but Googling shows this is quite a common problem with no apparent solution.

[Ilia]

https://kb.isc.org/docs/aa-00340

Mike, you never mention neither distro version and type, nor your BIND version.

[Mike H]

Apologies.
CentOS Linux 7.7.1908 x64
BIND version 9.11
Webmin version 1.942
Usermin version 1.791
Virtualmin version 6.09

[Ilia]

Do you get any valuable output on journalctl -xe command? Do you have SELinux enabled?

[Mike H]

Sorry for the delay. I'd just restarted the server so there was no info.. The results are below. I've been restarting named on a cron job every 6 hours, and just now it went again, so it's lasted almost 5 days this time. SELinux is disabled:
sestatus
SELinux status: disabled

Apr 20 16:21:41 webhost systemd[1]: Started Berkeley Internet Name Domain (DNS).
-- Subject: Unit named.service has finished start-up
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
--
-- Unit named.service has finished starting up.
--
-- The start-up result is done.
Apr 20 16:21:41 webhost named[34960]: zone MYTLD.com/IN: sending notifies (serial 1580921303)
Apr 20 16:21:41 webhost named[34960]: zone MYTLD.co.uk/IN: sending notifies (serial 1580921339)
Apr 20 16:21:41 webhost named[34960]: network unreachable resolving './DNSKEY/IN': 2001:500:a8::e#53
Apr 20 16:21:41 webhost named[34960]: network unreachable resolving './NS/IN': 2001:500:a8::e#53
Apr 20 16:21:41 webhost named[34960]: network unreachable resolving './DNSKEY/IN': 2001:dc3::35#53
Apr 20 16:21:41 webhost named[34960]: network unreachable resolving './NS/IN': 2001:dc3::35#53
Apr 20 16:21:41 webhost named[34960]: network unreachable resolving './DNSKEY/IN': 2001:500:2f::f#53
Apr 20 16:21:41 webhost named[34960]: network unreachable resolving './NS/IN': 2001:500:2f::f#53
Apr 20 16:21:41 webhost named[34960]: network unreachable resolving './DNSKEY/IN': 2001:500:9f::42#53
Apr 20 16:21:41 webhost named[34960]: network unreachable resolving './NS/IN': 2001:500:9f::42#53
Apr 20 16:21:41 webhost named[34960]: network unreachable resolving './NS/IN': 2001:500:2d::d#53
Apr 20 16:21:41 webhost polkitd[734]: Unregistered Authentication Agent for unix-process:34928:37534212 (system bus name :1.7968, object path /org/freedesktop/PolicyKit1/AuthenticationAgent, locale
Apr 20 16:21:41 webhost named[34960]: managed-keys-zone: Key 20326 for zone . acceptance timer complete: key now trusted
Apr 20 16:21:41 webhost named[34960]: resolver priming query complete
Apr 20 16:21:48 webhost named[34960]: network unreachable resolving 'getcitydetails.geobytes.com/A/IN': 2001:500:9f::42#53
Apr 20 16:21:48 webhost named[34960]: network unreachable resolving 'getcitydetails.geobytes.com/AAAA/IN': 2001:500:9f::42#53
Apr 20 16:21:50 webhost named[34960]: network

[Ilia]

It's fully patched, and is a VPS

What company exactly is that? What CPU option do you have chosen?

The results are below. I've been restarting named on a cron job every 6 hours, and just now it went again, so it's lasted almost 5 days this time.

Okay, you should study on system logs more. What is the output of:

grep -B5 -A5 /var/log/kern.log* -ie kill
dmesg | grep -i kill

[Ilia]

For CentOS it's probably better to go with:

grep -b5 -a5 -i -r 'killed process' /var/log

[xhsuaihud]

So one in all my absolute pinnacle necessities whilst searching at those systems like Webmin is the availabilty of TOTP 2FA, often with GA. I set up and configured this, but in no way scanned the qr code - it should tell you to verify the code with 6 digits - and despite not having achieved that it activates and need me to go into a code.
Now I thought I turned into foxy and created a test consumer for this Swing, but identical factor there, and that 2fa for the test account turned into by no means even enabled