[Opendnssec-user] Signature delay for one zone has one million domains

[yaohongyuan]

Hi all ,
>        I had one zone which has about more than one million domains . 
>        Recently noticed that when add a new domain under this zone almost cost 40 minutes . 
>        But the other zones were regular worked , just cost about 1 minutes to sign one new incoming RR record.(from in-bind throw opendnssec to out-bind).
>        All zones' config are the same . 
>        Is if one zone more than one million domains will beyond the opendnssec's control ? (I think 1,000,000 is not a large number for opendnssec)
>        And I did some change in config file , set re-sign per 5 minutes  , but the result is unsatisfactory ( from in-bind throw opendnssec to out-bind cost about 20+ minutes).
        
>        Performance test for our HSM , result is 2600 RR/S , but from log the avg is so far from this.
            Jan 27 16:42:24 SST03 ods-signerd: [STATS] XX 1453884069 RR[count=1 time=1(sec)] NSEC3[count=0 time=0(sec)] RRSIG[new=9 reused=1035661 time=34(sec) avg=0(sig/sec)] TOTAL[time=76(sec)] 


>        After check the syslog always met log as : 
>            Jan 27 16:58:13 SST03 ods-signerd: [query] incoming notify for zone XX
>            Jan 27 16:58:13 SST03 ods-signerd: [query] ignore notify from localhost: zone XX transfer in progress
>        How could I speed up the opendnssec to sign this zone timely ?
>        Could I deploy the opendnssec into a distributed cluster server to increase the opendnssec's processing speed?
>        We used opendnssec version is 1.4.7.
>        Could anybody please help me to fix this issue together?

        Current I use a 128G memory's machine to do the same work that didn't use the swap  , but it's not work the Signature delay about 30 minutes , and from system log below words frequently appeared.
>            Jan 27 16:58:13 SST03 ods-signerd: [query] incoming notify for zone XX
>            Jan 27 16:58:13 SST03 ods-signerd: [query] ignore notify from localhost: zone XX transfer in progress
With kind regards, Dean
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.opendnssec.org/pipermail/opendnssec-user/attachments/20160310/94ad033a/attachment.htm>