DHCPD[4.3.5]错误：
无法将转发地图从 nvhenz710.hen.mentats.us 添加到 172.24.1.31：SERVFAIL
BIND 9.11.1-P2-RedHat-9.11.1-2.P2.fc26 中没有错误
$ groups named dhcpd
named : named dhcpd
dhcpd : dhcpd named
selinux permissive
tcpdump 看起来很干净（它正在与同一台服务器上的 bind 对话）
命名的.conf：
//
// named.conf
//
options {
listen-on port 53 { 127.0.0.1; 172.24.251.251;};
/* listen-on-v6 port 53 { ::1; }; */
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
allow-query { 172.24.0.0/16; 192.168.122.0/24; localnets; };
allow-update { 172.24.0.0/16; localnets; };
recursion yes;
dnssec-enable yes;
dnssec-validation yes;
dnssec-lookaside auto;
/* Path to ISC DLV key */
bindkeys-file "/etc/bind/bind.keys.v9_11";
managed-keys-directory "/var/named/dynamic";
forwarders {
8.8.8.8;
8.8.4.4;
};
disable-empty-zone "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.IP6.ARPA";
};
zone "." IN {
type hint;
file "named.ca";
};
include "/etc/named.root.key";
//
// Do any local configuration here
//
//
// max logging template
//
//logging {
//category "default" { "debug"; };
//category "general" { "debug"; };
//category "database" { "debug"; };
//category "security" { "debug"; };
//category "config" { "debug"; };
//category "resolver" { "debug"; };
//category "xfer-in" { "debug"; };
//category "xfer-out" { "debug"; };
//category "notify" { "debug"; };
//category "client" { "debug"; };
//category "unmatched" { "debug"; };
//category "network" { "debug"; };
//category "update" { "debug"; };
//category "queries" { "debug"; };
//category "dispatch" { "debug"; };
//category "dnssec" { "debug"; };
//category "lame-servers" { "debug"; };
//channel "debug" {
//file "/var/named/data/nameddbg" versions 2 size 50m;
//print-time yes;
//print-category yes;
//};
//};
//
logging {
category "general" { "debug"; };
category "unmatched" { "debug"; };
category "queries" { "debug"; };
category "resolver" { "debug"; };
category "update" { "debug"; };
category "security" { "debug"; };
channel "debug" {
syslog;
print-time yes;
print-category yes;
};
};
// Consider adding the 1918 zones here, if they are not used in your
// organization
//include "/etc/bind/zones.rfc1918";
#make sure permissions are -rw-r-----. 1 root named
include "/etc/rndc.key";
acl "xfer" {
/* Deny transfers by default except for the listed hosts.
* If we have other name servers, place them here.
*/
172.24.241.241;
172.24.242.242;
172.24.243.243;
172.24.252.252;
};
/*
* DNSSEC Look-aside Validation
* see https://www.isc.org/downloads/bind/dlv/#dlv_key
*/
trusted-keys {
dlv.isc.org. 257 3 5 "BEAAAAPHMu/5onzrEE7z1egmhg/WPO0+ju
oZrW3euWEn4MxDCE1+lLy2brhQv5rN32RKtMzX6Mj70jdzeND4XknW58
dnJNPCxn8+jAGl2FZLK8t+1uq4W+nnA3qO2+DL+k6BD4mewMLbIYFwe0
PG73Te9fZ2kJb56dhgMde5ymX4BI/oQ+cAK50/xvJv00Frf8kw6ucMTw
FlgPe+jnGxPPEmHAte/URkY62ZfkLoBAADLHQ9IrS2tryAe7mbBZVcOw
IeU/Rw/mRx/vwwMCTgNboMQKtUdvNXDrYJDSHZws3xiRXF1Rf+al9UmZ
fSav/4NWLKjHzpT59k/VStTDN0YUuWrBNh";
};
/*
* You might put in here some ips which are allowed to use the cache or
* recursive queries
*/
acl "trusted" {
172.24.250.250;
172.24.251.251;
172.24.252.252;
172.24.241.241;
172.24.242.242;
172.24.243.243;
127.0.0.0/8;
::1/128;
};
//zone "localhost" IN {
// type master;
// file "pri/localhost.zone";
// notify no;
//};
//zone "127.in-addr.arpa" IN {
// type master;
// file "pri/127.zone";
// notify no;
//};
/*
* Briefly, a zone which has been declared delegation-only will be effectively
* limited to containing NS RRs for subdomains, but no actual data beyond its
* own apex (for example, its SOA RR and apex NS RRset). This can be used to
* filter out "wildcard" or "synthesized" data from NAT boxes or from
* authoritative name servers whose undelegated (in-zone) data is of no
* interest.
* See http://www.isc.org/software/bind/delegation-only for more info
*/
zone "hen.mentats.us." {
type master;
file "zones/hen.mentats.us.hosts";
allow-update { 172.24.0.0/16; localnets; };
}; //end hen zone
zone "24.172.in-addr.arpa." {
type master;
file "zones/172.24.rev";
}; // end 172.24/16 zone
zone "122.168.192.in-addr.arpa." {
type master;
file "zones/192.168.122.rev";
}; // end 1.168 zone
controls {
inet 172.24.251.251 allow { any; } keys { "rndc-key"; };
inet 172.24.252.252 allow { any; } keys { "rndc-key"; };
inet 172.24.241.241 allow { any; } keys { "rndc-key"; };
inet 172.24.242.242 allow { any; } keys { "rndc-key"; };
inet 172.24.243.243 allow { any; } keys { "rndc-key"; };
inet 127.0.0.1 allow { any; } keys { "rndc-key"; };
};
命名和区域位于非默认位置
$ ll -a /var/named/zones/
drwxrwxr-x. 1 named named 166 Sep 17 22:27 ./
drwxr-x---. 1 root named 148 Sep 16 14:08 ../
-rw-rw-r--. 1 named named 1.8K Sep 16 14:06 172.24.rev
-rw-rw-r--. 1 named named 0 Sep 17 22:27 172.24.rev.jnl
-rw-rw-r--. 1 named named 358 Sep 16 14:06 192.168.122.rev
-rw-rw-r--. 1 named named 2.9K Sep 16 14:06 hen.mentats.us.hosts
-rw-rw-r--. 1 named named 0 Sep 17 21:33 hen.mentats.us.hosts.jnl
关于如何获取有关失败原因/方式的更多详细信息，有什么建议吗？
是否有我错过的可以打开的 BIND 日志记录
答案1
确实是 jnl 文件的问题。我之前遇到过 selinux 问题，在解决这些问题的过程中，它显然留下了空文件。由于记录了所有查询，以及我过滤日志的方式（使用重启后跟踪），我错过了在命名启动时发出的投诉，这并没有导致服务失败，只是没有加载区域，因此 SERVFAIL。
删除 jnl 文件并重新启动命名，解决了问题。下一步是强制执行 selinux 并祈祷好运。感谢编辑清理了我的帖子。