var/log/messages question

[conners]

Hi all, I was wondering while looking through the messages log if the following should be there? They have nothing to do with my VPS server.

Jun 7 20:26:52 vps1 named[2612]: lame server resolving 'ns3.ameuro.net' (in 'ameuro.NET'?): 66.111.8.10#53
Jun 7 20:26:52 vps1 named[2612]: lame server resolving 'ns3.ameuro.net' (in 'ameuro.NET'?): 66.111.8.10#53
Jun 7 21:27:35 vps1 named[2608]: lame server resolving 'ns.ziom.co.kr' (in 'ziom.co.kr'?): 222.239.227.110#53
Jun 7 21:27:35 vps1 named[2608]: lame server resolving 'ns2.ziom.co.kr' (in 'ziom.co.kr'?): 222.239.227.110#53
Jun 7 21:27:41 vps1 named[2608]: lame server resolving 'NS1.PROMOBG.COM' (in 'PROMOBG.com'?): 87.118.140.32#53
Jun 7 21:27:41 vps1 named[2608]: lame server resolving 'NS2.PROMOBG.COM' (in 'PROMOBG.com'?): 87.118.140.32#53
Jun 7 21:27:45 vps1 named[2608]: lame server resolving 'ns2.iptek.net.id' (in 'iptek.NET.id'?): 202.155.30.227#53
Jun 7 21:27:51 vps1 named[2608]: lame server resolving 'cpan.fluoline.net' (in 'fluoline.NET'?): 85.17.57.3#53
Jun 7 21:27:54 vps1 named[2608]: lame server resolving 'ns.utl.pt' (in 'utl.pt'?): 146.193.0.1#53

and i seee this also: oom-killer: gfp_mask=0x1d2 no idea what that is but it doesn't look good to me.

thanks in advance

[madaboutlinux]

HI,

This is not actually a threat to your server but will keep filling your logs. You get those messages in the logs due to the fact that, the NS record for those domains specifies your server and that your server is not authoritative for those domain.

You will have to turn off recursion and logging for the lame server entries in named.conf Insert the below line in /etc/named.conf file


acl localip { 127.0.0.1; 1.1.1.1; };
// place the actual IP address above in place of 1.1.1.1
// if you have multiple IP addresses, you should add them all, separated by semi-colons

options {
allow-recursion {
localip;
};

logging {
category lame-servers { null; };
};


Restarted bind (named). That should do it.

If anybody else have a better solution, let me know.

Thanks.

[SageBrian]

I've always wondered what benefit there is for those domains adding my nameserver to their records.

If I have a domain name, why would I just put a random nameserver on the record?
Why wouldn't I just use the registrar's nameserver?

I'm curious if it is some sort of search for misconfigured nameservers?

[vagsoftware]

Wassup,

I have one link for you

http://www.dnsreport.com/

Follow the diagnose and solve step by step the problems. Also do not permit AXFR transfers from you DNSes and restrict logging, all from named.conf. I recomand you also to have TXT record for mail servers (mail.domain.com. 3600 IN TXT "v=spfl a -all").

Respekt.

[conners]

Hey thanks for all the replys. I've ben away and just now am able to catch up. i'll look at all of your sugestions.