# Remember to double check your DNS resolver configuration

**URL:** <https://community.zeek.org/t/remember-to-double-check-your-dns-resolver-configuration/4643>\
**Category:** Zeek\
**Created:** [February 6, 2017, 3:31pm UTC](https://community.zeek.org/t/remember-to-double-check-your-dns-resolver-configuration/4643 "2017-02-06T15:31:23Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Hosom\_Stephen\_M](https://avatars.discourse-cdn.com/v4/letter/h/d26b3c/32.png) [@Hosom\_Stephen\_M](https://community.zeek.org/u/Hosom_Stephen_M)\
**Post date:** [February 6, 2017, 3:31pm UTC](https://community.zeek.org/t/remember-to-double-check-your-dns-resolver-configuration/4643/1 "2017-02-06T15:31:23Z")

</div>

I’ve been troubleshooting an issue where a single node would have all of its workers grow in memory until they would be OOM killed. The troubleshooting process spanned multiple days and I only happened to come across this with some help from Justin combined with a thread on the issue tracker ([https://bro-tracker.atlassian.net/browse/BIT-1482](https://bro-tracker.atlassian.net/browse/BIT-1482)).

Keep in mind that when you are using the MHR script (enabled by default) or the notary script, your Bro workers are performing a LOT of DNS. In my case I was using both. Since lookup\_host\_txt and lookup\_host never return if the worker node doesn’t reach a DNS server, this results in what would appear to be a new thread for each new DNS query when your DNS resolvers are misconfigured.

---

<div class="post-metadata">

**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\
**Post date:** [February 9, 2017, 6:22pm UTC](https://community.zeek.org/t/remember-to-double-check-your-dns-resolver-configuration/4643/2 "2017-02-09T18:22:01Z")

</div>

Did evidence of this show up in stats.log? There are some fields that track the amount of DNS actively being performed by Bro in there.

&nbsp;&nbsp;.Seth

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:44pm UTC](https://community.zeek.org/t/remember-to-double-check-your-dns-resolver-configuration/4643/3 "2022-05-06T15:44:35Z")

</div>


