Lots of DNS querys from Zabbix Agent

[markfree]

My local router serves my network as a DNS server and logs show lots of queries started from itself and another host from the network, mostly from the router itself.
I tryed to follow the router's "dnsmasq.log" and saw a huge amount of constant DNS querys for A and AAAA values for my Zabbix server host (192.168.1.6).

They all seem to come from the router itself

Feb 3 23:20:11 dnsmasq[16662]: query[A] [zabbix_server_hostname] [B]from 127.0.0.1[/B]
Feb 3 23:20:11 dnsmasq[16662]: query[A] [zabbix_server_hostname] [B]from 127.0.0.1[/B]
Feb 3 23:20:11 dnsmasq[16662]: /etc/hosts.dnsmasq [zabbix_server_hostname] is 192.168.1.6
Feb 3 23:20:11 dnsmasq[16662]: /etc/hosts.dnsmasq [zabbix_server_hostname] is 192.168.1.6
Feb 3 23:20:11 dnsmasq[16662]: query[AAAA] [zabbix_server_hostname] [B]from 127.0.0.1[/B]
Feb 3 23:20:11 dnsmasq[16662]: query[AAAA] [zabbix_server_hostname] [B]from 127.0.0.1[/B]
Feb 3 23:20:11 dnsmasq[16662]: config [zabbix_server_hostname] is NODATA-IPv6
Feb 3 23:20:11 dnsmasq[16662]: config [zabbix_server_hostname] is NODATA-IPv6

And sometimes from another host.

Feb 3 23:20:13 dnsmasq[16662]: query[A] [zabbix_server_hostname] [B]from 192.168.1.5[/B]
Feb 3 23:20:13 dnsmasq[16662]: query[A] [zabbix_server_hostname] [B]from 192.168.1.5[/B]
Feb 3 23:20:13 dnsmasq[16662]: /etc/hosts.dnsmasq [zabbix_server_hostname] is 192.168.1.6
Feb 3 23:20:13 dnsmasq[16662]: /etc/hosts.dnsmasq [zabbix_server_hostname] is 192.168.1.6
Feb 3 23:20:13 dnsmasq[16662]: query[AAAA] [zabbix_server_hostname] [B]from 192.168.1.5[/B]
Feb 3 23:20:13 dnsmasq[16662]: query[AAAA] [zabbix_server_hostname] [B]from 192.168.1.5[/B]
Feb 3 23:20:13 dnsmasq[16662]: config [zabbix_server_hostname] is NODATA-IPv6
Feb 3 23:20:13 dnsmasq[16662]: config [zabbix_server_hostname] is NODATA-IPv6

So, I stopped my router's Zabbix agent and the queries stopped as well.

My server comunicates fine with the router's agent and all items seem to work fine.
I reviewed the agent's configuration and it seems to have nothing wrong.
Looking at the agent log, there's nothing at all, just that it started.

I'm not sure what's that about.

Why would the agent keep querying so much for the server's ip?

[markfree]

I've found this tread reporting a similar behavior.
And it also pointed to this feature request.

What I understood so far is that Zabbix Agent queries DNS every time it sends data to the server if we set up "Server" or "ServerActive" parameter to a hostname/domain_name (which is what I did).

There is no DNS cache implemented at Zabbix.

zabbix daemons don't do any dns caching

And it seems there won't be any change in that behavior, despite years of discussion, as clearly stated:

Caching domain names has no place to be within ZABBIX applications.

Someone suggested "setting short hostname in "Server=" and "ServerActive=". (like Server=zabbix instead of Server=zabbix.mydomain)".
But that doesn't work.

The only workaround I was able to infer is to use actual IP for "Server" option.
I guess that is a viable solution, but not an optimal one.

After I setting up my agent to send data to server with IP 192.168.1.6, that huge amount of DNS queries stopped immediately.
Then I should do the same for every host with an agent configured.

Also, the above request suggests using "nscd" but I haven't tried that yet.

I wonder if that could be affecting the host performance? In my case, my DNS log was filling up quite fast.
There must be a better way...

[markfree]

Just to add up, whenever Zabbix Agent uses a hostname instead of an IP address, it keeps generating DNS requests.
Since the server name is already cached, DNS server only responds the IP address.

My Zabbix Server takes at least 1 minute to request any data, still, the agent keeps querying every second.

My issue is that the agent is querying DNS every freaking second , therefore, generating huge amounts of dnsmasq logs.

Anyone knows how to change this behavior?

[whisky17]

Hi, did you found any solution?

I've setup a BIND9-Caching-Server. But request from Zabbix seem to ignore the caching. Therefore tons of request from my Zabbix are penetrating my nameserver per second, instead of being cached by the zabbix-machine locally.
resolv.conf is configured rightly. Requests by dig or nslookup are also cached by BIND as expected.

Has Zabbix any other config for nameserver?

[tim.mooney]

My Zabbix Server takes at least 1 minute to request any data, still, the agent keeps querying every second.

Wow, that seems incredibly broken.

I agree that Zabbix shouldn't be building DNS caching into its agent; that's what things like caching nameservers are for.

However, repeatedly sending queries every second is clearly not great behavior, even if you're running a caching nameserver.

[markfree]

whisky17
Hi, did you found any solution?

No, I have not.

I haven't looked much into this. The only workaround I found so far its to use IP instead of hostname/domain name at agent's "server" parameter.

Lately I've been using Zabbix Agent 2 and unfortunatly the behavior is the same.
I just tested one of my hosts and, upon changing the server parameter to a hostname, lots of queries start popping up at the DNS server.
In the span of about 3 minutes, I logged 109 DNS "A" queries just for a single host.

[sosogh]

I have the same problem . why will zabbix agent make a dns query request every second ?
This issue (Zabbix agent is generating a lot of dns requests ) have been last for such a long time , from 2012 till now .

The workaround may be :
1 using IP instead of hostname/domain name of the zabbix server
or
2 set a host record in /etc/hosts in the zabbix agent machine.

[markfree]

NSCD seems to be a common tool that helps reduce the amount of name lookups. Despite its benefits, it seems that some applications can bypass its cache, and Zabbix Agent may be one of them.
During testing, the Zabbix Agent kept requesting the DNS server for the Zabbix Server's name while NSCD was active.
Has anyone noticed this?

I've also included an analysis on Github for future reference.