[BlueOnyx:11715] Re: help with /var/log/messages? dns issue?

[Chris Gebhardt - VIRTBIZ Internet]

Hi Tim,

On 11/28/2012 12:44 PM, webmaster wrote:
>
> All of a sudden I am seeing (examples below) in my /var/log/messages.
>
> Lot's of them
>
> FTP has been really slow since this has been happening.
>
> Machine has been rebooted. Same after reboot
>
> I have changed nothing on my server recently
>
> Machine hosts vsites and is my primary DNS server  and is running BX 5108R
>
> Anyone help me with what is happening and how to get it stopped?
>
>
>
> Snips from /var/log/messages
>
>
> Seeing things like this
>
> Nov 28 12:34:46 cabin2 named[15444]: error (unexpected RCODE REFUSED)
> resolving '172.151.58.47.in-addr.arpa/PTR/IN': 212.145.4.98#53
> Nov 28 12:34:46 cabin2 named[15444]: error (unexpected RCODE REFUSED)
> resolving '172.151.58.47.in-addr.arpa/PTR/IN': 212.145.4.97#53
> Nov 28 12:34:47 cabin2 named[15444]: error (unexpected RCODE REFUSED)
> resolving '172.151.58.47.in-addr.arpa/PTR/IN': 212.145.4.98#53

Yeah, this does look like a DNS issue.  From the looks of things, there 
are some recursive lookups that are attempting to be done.  Hopefully, 
you're blocking recursives by un-checking the "Cache Record Lookups" box 
at Network Services > DNS > Advanced.

Then also go to Network Services > FTP and make sure that "Hostname 
Lookups" is not selected.   There's really no reason to do lookups on 
FTP connections.  Honestly, for my own troubleshooting purposes, having 
the hostname lookups on actually makes things more difficult when it 
comes to scanning the logs for what may be good or bad.

Let us know if that clears things up for you.

-- 
Chris Gebhardt
VIRTBIZ Internet Services
Access, Web Hosting, Colocation, Dedicated
www.virtbiz.com | toll-free (866) 4 VIRTBIZ