<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META content="text/html; charset=us-ascii" http-equiv=Content-Type>
<STYLE>
BLOCKQUOTE {
MARGIN-TOP: 0px; MARGIN-BOTTOM: 0px; MARGIN-LEFT: 2em
}
OL {
MARGIN-TOP: 0px; MARGIN-BOTTOM: 0px
}
UL {
MARGIN-TOP: 0px; MARGIN-BOTTOM: 0px
}
P {
MARGIN-TOP: 0px; MARGIN-BOTTOM: 0px
}
BODY {
LINE-HEIGHT: 1.5; FONT-FAMILY: 宋体; COLOR: #000000; FONT-SIZE: 10.5pt
}
</STYLE>
<META name=GENERATOR content="MSHTML 8.00.6001.18702"></HEAD>
<BODY style="MARGIN: 10px">
<DIV>Hi Matthijs,</DIV>
<DIV>
<DIV>>You can either run ods-signer <zone> for each zone, or ods-signer sign</DIV>
<DIV>>- --all to schedule them all. The automatic resigning will still work.</DIV>
<DIV>>The ods-signer sign command is there just to tell OpenDNSSEC there is</DIV>
<DIV>>new zone content. A zone will never be worked on more than once at a</DIV>
<DIV>>time: if a sign task is currently being done, an ods-signer sign</DIV>
<DIV>>command will be scheduled after the current sign task is finished.</DIV></DIV>
<DIV><SPAN></SPAN> </DIV>
<DIV><SPAN>We want to know if there is a way to disable the automatic resigning
</SPAN></DIV>
<DIV><SPAN>because it will only sign the RRs </SPAN><SPAN>in the memory which do
not contain </SPAN></DIV>
<DIV><SPAN>newly add RRs. And I know that the only way that can make the newly
</SPAN></DIV>
<DIV><SPAN>add RRs signed by ods-signerd is by running ods-signer sign
<zone> or</SPAN></DIV>
<DIV><SPAN>--all, but the automatic resigning will not stop working even there
</SPAN></DIV>
<DIV><SPAN>will not be two or more ods-signerd signing the same zone at
the same</SPAN></DIV>
<DIV><SPAN>time. But I think the automatic resigning is useless in this
situation</SPAN></DIV>
<DIV><SPAN>that our RRs are in a quick changing environment, I want to
sign only </SPAN></DIV>
<DIV><SPAN>the current status of the zone data which the automatic resigning
will</SPAN></DIV>
<DIV><SPAN>not satisfy at some time.</SPAN></DIV>
<DIV><SPAN></SPAN> </DIV>
<DIV><SPAN>e.g. I want re-load the whole data from db at every 15min and
generate new</SPAN></DIV>
<DIV><SPAN>zone files, after new zone files </SPAN><SPAN>are generated, I would
run ods-signer sign </SPAN><SPAN>--all </SPAN></DIV>
<DIV><SPAN>to sign all the zones. When </SPAN><SPAN>zones are signed I would
make BIND reload them </SPAN></DIV>
<DIV><SPAN>immediately, there could be a situation that just after BIND's
reloading then </SPAN></DIV>
<DIV><SPAN>the automatic </SPAN><SPAN>resigning get the opportunity
</SPAN><SPAN>to sign the zones in the memory, all of </SPAN></DIV>
<DIV><SPAN>which are signed just now by manually-executed </SPAN><SPAN>command,
and at this time BIND</SPAN></DIV>
<DIV><SPAN>will reload the zones again which have the same RRs. So I think it's
useful to</SPAN></DIV>
<DIV><SPAN>have the feature of disable automatic resigning and let
manually-executed command</SPAN></DIV>
<DIV><SPAN>take over the signing function. The advantages are that the RRs are
the right ones </SPAN></DIV>
<DIV><SPAN>in db and free the CPU from resigning the same data again which is
set off by automatic</SPAN></DIV>
<DIV><SPAN>resigning. Or I think the automatic resigning should reload
</SPAN></DIV>
<DIV><SPAN>the data from /unsigned directory instead of resigning the RRs in the
memory.</SPAN></DIV>
<DIV><SPAN></SPAN> </DIV>
<DIV><SPAN>I hope I have explained clearly, any suggestions?</SPAN></DIV>
<DIV><SPAN></SPAN> </DIV>
<DIV><SPAN></SPAN> </DIV>
<DIV><SPAN>Best regards,</SPAN></DIV>
<DIV><SPAN>Stuart</SPAN></DIV>
<DIV><SPAN></SPAN> </DIV></BODY></HTML>