SOLVED Nameserver Selection suddenly changed from Bind to NSD

Shood

Well-Known Member
Aug 12, 2015
85
17
133
Middle East
cPanel Access Level
Root Administrator
Hello,
My server surprised me today that "Nameserver Selection" is set to NSD, I'm sure that there's something happened in the server caused the changing from BIND to NSD, (of course not me who did that) because I'm always using BIND with all my servers and I've already set it to BIND when I created it for the first time.
I think from my self experience that BIND is the best choice and this ticket on cPanel that I always help me supports my opinion.
I've already tried NSD with one of my servers before years and caused some unknown problems.

However,
Is there a way to know how and when this changing happened?
Are there expected problems may occur If I set it back to BIND?
Thank you
 

cPanelLauren

Product Owner
Staff member
Nov 14, 2017
13,295
1,273
313
Houston
Hello,

I can't think of anything that would automatically change the nameserver selection like this

If the modification was made recently through WHM you can see the change in the cPanel access logs at /usr/local/cpanel/logs/access_log and search for "doconfigurenameserver?nameserver=nsd"

I did the following:

Code:
grep "doconfigurenameserver?nameserver=nsd" /usr/local/cpanel/logs/access_log
 

Shood

Well-Known Member
Aug 12, 2015
85
17
133
Middle East
cPanel Access Level
Root Administrator
Hello,

I can't think of anything that would automatically change the nameserver selection like this

If the modification was made recently through WHM you can see the change in the cPanel access logs at /usr/local/cpanel/logs/access_log and search for "doconfigurenameserver?nameserver=nsd"

I did the following:

Code:
grep "doconfigurenameserver?nameserver=nsd" /usr/local/cpanel/logs/access_log
Hello @cPanelLauren,
Of course you know better, and it's possible that me who did that by a mistake.
I'm just feel strange how this done while I don't prefer NSD and I'm sure that I've set server to BIND upon setting it for the first time.

Anyway, no matter what's the status of my server now NSD or BIND, the most important issue is to know if me who did this change or someone else for any reason, So if you can please make a little investigation through the listed below output in the cPanel access logs?

I found this IP in the output (193.111.60.5) this IP is not for me at all, I looked it on arin.net, unfortunately I didn't get a helpful feedback.
Could you please calm me, do you see this is a normal of there's something unusual?

That's the output:
=========
Code:
root [/]# grep "doconfigurenameserver?nameserver=nsd" /usr/local/cpanel/logs/access_log
193.111.60.5 - root [04/11/2018:12:57:13 -0000] "GET /cPanel_magic_revision_1424892677/libraries/fontawesome/css/font-awesome.min.css HTTP/1.1" 200 0 "https://[my_server_IP]:2087/cpsess1418036539/scripts/doconfigurenameserver?nameserver=nsd" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/65.0.3325.181 Chrome/65.0.3325.181 Safari/537.36" "s" "-" 2087
193.111.60.5 - root [04/11/2018:12:57:13 -0000] "GET /cPanel_magic_revision_1521648433/templates/menu/top_frame.min.css HTTP/1.1" 200 0 "https://[my_server_IP]:2087/cpsess1418036539/scripts/doconfigurenameserver?nameserver=nsd" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/65.0.3325.181 Chrome/65.0.3325.181 Safari/537.36" "s" "-" 2087
193.111.60.5 - root [04/11/2018:12:57:13 -0000] "GET /cPanel_magic_revision_1521648433/combined_optimized.css HTTP/1.1" 200 0 "https://[my_server_IP]:2087/cpsess1418036539/scripts/doconfigurenameserver?nameserver=nsd" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/65.0.3325.181 Chrome/65.0.3325.181 Safari/537.36" "s" "-" 2087
193.111.60.5 - root [04/11/2018:12:57:13 -0000] "GET /cPanel_magic_revision_1521648433/templates/menu/command.min.css HTTP/1.1" 200 0 "https://[my_server_IP]:2087/cpsess1418036539/scripts/doconfigurenameserver?nameserver=nsd" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/65.0.3325.181 Chrome/65.0.3325.181 Safari/537.36" "s" "-" 2087
193.111.60.5 - root [04/11/2018:12:57:13 -0000] "GET /cPanel_magic_revision_1521648433/themes/x/style_optimized.css HTTP/1.1" 200 0 "https://[my_server_IP]:2087/cpsess1418036539/scripts/doconfigurenameserver?nameserver=nsd" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/65.0.3325.181 Chrome/65.0.3325.181 Safari/537.36" "s" "-" 2087
193.111.60.5 - root [04/11/2018:12:57:20 -0000] "GET /cPanel_magic_revision_1386192030/3rdparty/ui-fonts/open_sans/optimized/open_sans.min.css HTTP/1.1" 200 0 "https://[my_server_IP]:2087/cpsess1418036539/scripts/doconfigurenameserver?nameserver=nsd" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/65.0.3325.181 Chrome/65.0.3325.181 Safari/537.36" "s" "-" 2087
193.111.60.5 - root [04/11/2018:12:57:20 -0000] "GET /cpsess1418036539/json-api/loadavg HTTP/1.1" 200 0 "https://[my_server_IP]:2087/cpsess1418036539/scripts/doconfigurenameserver?nameserver=nsd" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/65.0.3325.181 Chrome/65.0.3325.181 Safari/537.36" "s" "-" 2087
193.111.60.5 - root [04/11/2018:12:57:20 -0000] "GET /cpsess1418036539/json-api/get_update_availability?api.version=1 HTTP/1.1" 200 0 "https://[my_server_IP]:2087/cpsess1418036539/scripts/doconfigurenameserver?nameserver=nsd" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/65.0.3325.181 Chrome/65.0.3325.181 Safari/537.36" "s" "-" 2087
193.111.60.5 - root [04/11/2018:12:57:20 -0000] "POST /cpsess1418036539/json-api/nvset HTTP/1.1" 200 0 "https://[my_server_IP]:2087/cpsess1418036539/scripts/doconfigurenameserver?nameserver=nsd" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/65.0.3325.181 Chrome/65.0.3325.181 Safari/537.36" "s" "-" 2087
193.111.60.5 - root [04/11/2018:12:57:14 -0000] "GET /cpsess1418036539/scripts/doconfigurenameserver?nameserver=nsd HTTP/1.1" 200 0 "https://[my_server_IP]:2087/cpsess1418036539/scripts/nameserverconfig" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/65.0.3325.181 Chrome/65.0.3325.181 Safari/537.36" "s" "-" 2087
193.111.60.5 - root [04/11/2018:12:57:29 -0000] "GET /cpsess1418036539/json-api/loadavg HTTP/1.1" 200 0 "https://[my_server_IP]:2087/cpsess1418036539/scripts/doconfigurenameserver?nameserver=nsd" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/65.0.3325.181 Chrome/65.0.3325.181 Safari/537.36" "s" "-" 2087
193.111.60.5 - root [04/11/2018:12:57:35 -0000] "GET /cpsess1418036539/json-api/loadavg HTTP/1.1" 200 0 "https://[my_server_IP]:2087/cpsess1418036539/scripts/doconfigurenameserver?nameserver=nsd" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/65.0.3325.181 Chrome/65.0.3325.181 Safari/537.36" "s" "-" 2087
193.111.60.5 - root [04/11/2018:12:57:51 -0000] "GET /cpsess1418036539/json-api/loadavg HTTP/1.1" 200 0 "https://[my_server_IP]:2087/cpsess1418036539/scripts/doconfigurenameserver?nameserver=nsd" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/65.0.3325.181 Chrome/65.0.3325.181 Safari/537.36" "s" "-" 2087
193.111.60.5 - root [04/11/2018:12:58:22 -0000] "GET /cpsess1418036539/json-api/loadavg HTTP/1.1" 200 0 "https://[my_server_IP]:2087/cpsess1418036539/scripts/doconfigurenameserver?nameserver=nsd" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/65.0.3325.181 Chrome/65.0.3325.181 Safari/537.36" "s" "-" 2087
193.111.60.5 - root [04/11/2018:12:58:53 -0000] "GET /cpsess1418036539/json-api/loadavg HTTP/1.1" 200 0 "https://[my_server_IP]:2087/cpsess1418036539/scripts/doconfigurenameserver?nameserver=nsd" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/65.0.3325.181 Chrome/65.0.3325.181 Safari/537.36" "s" "-" 2087
193.111.60.5 - root [04/11/2018:12:59:09 -0000] "GET /cpsess1418036539/json-api/loadavg HTTP/1.1" 200 0 "https://[my_server_IP]:2087/cpsess1418036539/scripts/doconfigurenameserver?nameserver=nsd" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/65.0.3325.181 Chrome/65.0.3325.181 Safari/537.36" "s" "-" 2087
193.111.60.5 - root [04/11/2018:12:59:25 -0000] "GET /cpsess1418036539/json-api/loadavg HTTP/1.1" 200 0 "https://[my_server_IP]:2087/cpsess1418036539/scripts/doconfigurenameserver?nameserver=nsd" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/65.0.3325.181 Chrome/65.0.3325.181 Safari/537.36" "s" "-" 2087
193.111.60.5 - root [04/11/2018:12:59:40 -0000] "GET /cpsess1418036539/json-api/loadavg HTTP/1.1" 200 0 "https://[my_server_IP]:2087/cpsess1418036539/scripts/doconfigurenameserver?nameserver=nsd" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/65.0.3325.181 Chrome/65.0.3325.181 Safari/537.36" "s" "-" 2087
193.111.60.5 - root [04/11/2018:12:59:55 -0000] "GET /cpsess1418036539/json-api/loadavg HTTP/1.1" 200 0 "https://[my_server_IP]:2087/cpsess1418036539/scripts/doconfigurenameserver?nameserver=nsd" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/65.0.3325.181 Chrome/65.0.3325.181 Safari/537.36" "s" "-" 2087
193.111.60.5 - root [04/11/2018:13:00:11 -0000] "GET /cpsess1418036539/json-api/loadavg HTTP/1.1" 200 0 "https://[my_server_IP]:2087/cpsess1418036539/scripts/doconfigurenameserver?nameserver=nsd" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/65.0.3325.181 Chrome/65.0.3325.181 Safari/537.36" "s" "-" 2087
193.111.60.5 - root [04/11/2018:13:00:27 -0000] "GET /cpsess1418036539/json-api/loadavg HTTP/1.1" 200 0 "https://[my_server_IP]:2087/cpsess1418036539/scripts/doconfigurenameserver?nameserver=nsd" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/65.0.3325.181 Chrome/65.0.3325.181 Safari/537.36" "s" "-" 2087
193.111.60.5 - root [04/11/2018:13:00:43 -0000] "GET /cpsess1418036539/json-api/loadavg HTTP/1.1" 200 0 "https://[my_server_IP]:2087/cpsess1418036539/scripts/doconfigurenameserver?nameserver=nsd" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/65.0.3325.181 Chrome/65.0.3325.181 Safari/537.36" "s" "-" 2087
193.111.60.5 - root [04/11/2018:13:00:59 -0000] "GET /cpsess1418036539/json-api/loadavg HTTP/1.1" 200 0 "https://[my_server_IP]:2087/cpsess1418036539/scripts/doconfigurenameserver?nameserver=nsd" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/65.0.3325.181 Chrome/65.0.3325.181 Safari/537.36" "s" "-" 2087
193.111.60.5 - root [04/11/2018:13:01:15 -0000] "GET /cpsess1418036539/json-api/loadavg HTTP/1.1" 200 0 "https://[my_server_IP]:2087/cpsess1418036539/scripts/doconfigurenameserver?nameserver=nsd" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/65.0.3325.181 Chrome/65.0.3325.181 Safari/537.36" "s" "-" 2087
193.111.60.5 - root [04/11/2018:13:01:31 -0000] "GET /cpsess1418036539/json-api/loadavg HTTP/1.1" 200 0 "https://[my_server_IP]:2087/cpsess1418036539/scripts/doconfigurenameserver?nameserver=nsd" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/65.0.3325.181 Chrome/65.0.3325.181 Safari/537.36" "s" "-" 2087
193.111.60.5 - root [04/11/2018:13:01:47 -0000] "GET /cpsess1418036539/json-api/loadavg HTTP/1.1" 200 0 "https://[my_server_IP]:2087/cpsess1418036539/scripts/doconfigurenameserver?nameserver=nsd" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/65.0.3325.181 Chrome/65.0.3325.181 Safari/537.36" "s" "-" 2087
193.111.60.5 - root [04/11/2018:13:02:03 -0000] "GET /cpsess1418036539/json-api/loadavg HTTP/1.1" 200 0 "https://[my_server_IP]:2087/cpsess1418036539/scripts/doconfigurenameserver?nameserver=nsd" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/65.0.3325.181 Chrome/65.0.3325.181 Safari/537.36" "s" "-" 2087
193.111.60.5 - root [04/11/2018:13:02:19 -0000] "GET /cpsess1418036539/json-api/loadavg HTTP/1.1" 200 0 "https://[my_server_IP]:2087/cpsess1418036539/scripts/doconfigurenameserver?nameserver=nsd" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/65.0.3325.181 Chrome/65.0.3325.181 Safari/537.36" "s" "-" 2087
root [/]# _
=========
 
Last edited:

cPanelLauren

Product Owner
Staff member
Nov 14, 2017
13,295
1,273
313
Houston
Hi @Shood


That IP definitely changed the nameserver per the access logs on April 11th, 2018 it appears to belong to a hosting/IT provider when performing a whois lookup "Wise Internet Solutions"
 

Shood

Well-Known Member
Aug 12, 2015
85
17
133
Middle East
cPanel Access Level
Root Administrator
Hi @cPanelLauren.
All is well, my hosting provider who did that, they are already know the best and I trust them.
Maybe this is my mistake from the beginning to post a thread instead of asking them before.
However, please mark this as resolved (I couldn't know how to do myself)
Thank you very much for your interesting.