Doc the "managed-keys.bind" and "managed-keys.bind.jnl" file. [rt20235]

diff --git a/CHANGES b/CHANGES
index c62f92496ce942fcc85c533a714f9d81ddb8b775..8ad105054b719908d42bfe31a83ec360d0577171 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+2725.  [doc]           Added information about the file "managed-keys.bind"
+                       to the ARM. [RT #20235]
+
 2724.  [bug]           Updates to a existing node in secure zone using NSEC
                        were failing. [RT #20448]
 

diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml
index c92446a270fc887f89046262536c3724f03f657c..c1764ab2f5f3b32d74001467e1eb48e5b1188183 100644 (file)
--- a/doc/arm/Bv9ARM-book.xml
+++ b/doc/arm/Bv9ARM-book.xml
@@ -18,7 +18,7 @@
  - PERFORMANCE OF THIS SOFTWARE.
 -->
 
-<!-- File: $Id: Bv9ARM-book.xml,v 1.437 2009/10/16 02:59:41 each Exp $ -->
+<!-- File: $Id: Bv9ARM-book.xml,v 1.438 2009/10/22 02:04:07 each Exp $ -->
 <book xmlns:xi="http://www.w3.org/2001/XInclude">
   <title>BIND 9 Administrator Reference Manual</title>
 
@@ -9232,6 +9232,21 @@ deny-answer-aliases { "example.net"; };
             <command>managed-keys</command> may only be set at the top
             level of <filename>named.conf</filename>, not within a view.
          </para>
+          <para>
+            In the current implementation, the managed keys database is
+            stored as a master-format zone file called
+            <filename>managed-keys.bind</filename>.  When the key database
+            is changed, the zone is updated.  As with any other dynamic
+            zone, changes will be written into a journal file,
+            <filename>managed-keys.bind.jnl</filename>.  They are committed
+            to the master file as soon as possible afterward; in the case
+            of the managed key database, this will usually occur within 30
+            seconds.  So, whenever <command>named</command> is using
+            automatic key maintenace, those two files can be expected to
+            exist in the working directory.  (For this reason among others,
+            the working directory should be always be writable by
+            <command>named</command>.)
+         </para>
          <para>
            If the <command>dnssec-lookaside</command> option is
            set to <userinput>auto</userinput>, <command>named</command>