Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have around 200k same entries in my /var/log/messages received from named, like:

Oct 29 15:48:34 server named[878]: client 75.100.*.*#56448: view external: query (cache) 'example.com.co/A/IN' denied

Where example.com.co is an external domain not related to my site and being blocked for some reasons. External view is configured as below:

view    "external" {
    recursion no;

    zone "." IN {
        type hint;
        file "/var/named/named.ca";
    };

zone "example2.com" {
        type master;
        file "/var/named/example2.db";
};
};

Where example2.com is my own domain. Could you please explain what actually does the log entry mean and what should I do to prevent it from being logged?

Thanks.

Configuration: CentOS 6, BIND 9.7

share|improve this question

1 Answer 1

It seems you have users querying your server for names that aren't yours. If the 200k log events are all from the same client IP address, I'd block that IP in my firewall for 24-48 hours to see if they stop and report them to their ISP. If they're from many different addresses (especially from different ISPs and different parts of the world), I'd spend some time to figure out why they're querying your server.

dig example.com.co. NS

Does the above command mistakenly list your name server as an authoritative one for their domain? If so, contact them using their whois contact information.

share|improve this answer
    
All IPs are different and ISP's as well. Interesting, but many domains are not existent and many of them are from porno resources. I've blocked most popular IP's but that didn't help much. Possible a DOS attack on my server? –  Andrew Oct 30 '11 at 0:00

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.