[Opendnssec-user] About opendnssec signature performance

[g***@zdns.cn]

Hi all ,
I had one zone which has about more than 15,000,000 domains .
Recently noticed that when add a new domain under this zone almost cost 10 minutes .
But the other zones were regular worked , just cost about 1 minutes to sign one new incoming RR record.(from in-bind throw opendnssec to out-bind).
All zones' config are the same .
Performance test for our HSM , result is 2600 RR/S , but from log the avg is so far from this.
Jan 18 10:28:00 p01-test-devops-9-81 ods-signerd: [STATS] XX 1484705894 RR[count=0 time=10(sec)] NSEC3[count=0 time=2(sec)] RRSIG[new=2 reused=15844627 time=133(sec) avg=0(sig/sec)] TOTAL[time=596(sec)]
How could I speed up the opendnssec to sign this zone timely ?
We used opendnssec version is 1.4.10
Could anybody please help me to fix this issue together?

With kind regards



***@zdns.cn

[Yuri Schaeffer]

Hi Gaolei,

Post by g***@zdns.cn
I had one zone which has about more than 15,000,000 domains .
Recently noticed that when add a new domain under this zone almost cost 10 minutes .

...

Post by g***@zdns.cn
We used opendnssec version is 1.4.10
Could anybody please help me to fix this issue together?

Sadly this is a problem for OpenDNSSEC at the moment. The signer doesn't
scale well for very large zones. It is not the signing performance per
se, it will sign a large zone just fine, but a problem in handling
updates in such zones.

It is very high on our wishlist to straighten this out. We will work on
this as our main goal for OpenDNSSEC 2.2 and 2.3.

I can imagine these updates get quicker a bit when using nsec instead of
nsec3. But for big improvements we'll have to wait the development.
Other than that check the signers memory consumption and make sure the
OS doesn't need to swap. Also, the signer will write out all kinds of
backup/temporary files in /var/opendnssec. Make sure those files are on
fast storage.

Best regards,
Yuri