Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I recently noticed that BIND has been producing a large amount of logs in /var/syslog relating to one particular server (ezdns)

Jun  3 03:29:24 overlook named[6586]: success resolving 'ns0.ezdns.tf/AAAA' (in 'ezdns.tf'?) after reducing the advertised EDNS UDP packet size to 512 octets
Jun  3 03:29:25 overlook named[6586]: success resolving 'ns4.ezdns.tf/A' (in 'ezdns.tf'?) after reducing the advertised EDNS UDP packet size to 512 octets
Jun  3 03:29:25 overlook named[6586]: success resolving 'ns4.ezdns.tf/AAAA' (in 'ezdns.tf'?) after reducing the advertised EDNS UDP packet size to 512 octets
Jun  3 03:29:25 overlook named[6586]: success resolving 'ns2.ezdns.tf/A' (in 'ezdns.tf'?) after reducing the advertised EDNS UDP packet size to 512 octets
Jun  3 03:29:25 overlook named[6586]: success resolving 'ns2.ezdns.tf/AAAA' (in 'ezdns.tf'?) after reducing the advertised EDNS UDP packet size to 512 octets
Jun  3 03:29:25 overlook named[6586]: success resolving 'ns5.ezdns.tf/A' (in 'ezdns.tf'?) after reducing the advertised EDNS UDP packet size to 512 octets
Jun  3 03:29:25 overlook named[6586]: success resolving 'ns5.ezdns.tf/AAAA' (in 'ezdns.tf'?) after reducing the advertised EDNS UDP packet size to 512 octets
Jun  3 03:29:25 overlook named[6586]: success resolving 'ns5.ezdns.ms/A' (in 'ezdns.ms'?) after disabling EDNS
Jun  3 03:29:25 overlook named[6586]: success resolving 'ns0.ezdns.pm/AAAA' (in 'ezdns.pm'?) after reducing the advertised EDNS UDP packet size to 512 octets
Jun  3 03:29:26 overlook named[6586]: success resolving 'ns3.ezdns.yt/AAAA' (in 'ezdns.yt'?) after reducing the advertised EDNS UDP packet size to 512 octets
Jun  3 03:29:26 overlook named[6586]: success resolving 'ns1.ezdns.pl/A' (in 'ezdns.pl'?) after reducing the advertised EDNS UDP packet size to 512 octets
Jun  3 03:29:27 overlook named[6586]: success resolving 'ns0.ezdns.it/AAAA' (in 'ezdns.it'?) after reducing the advertised EDNS UDP packet size to 512 octets
Jun  3 03:29:27 overlook named[6586]: success resolving 'ns1.ezdns.la/AAAA' (in 'ezdns.la'?) after disabling EDNS
Jun  3 03:29:27 overlook named[6586]: success resolving 'ns0.ezdns.yt/AAAA' (in 'ezdns.yt'?) after reducing the advertised EDNS UDP packet size to 512 octets
Jun  3 03:29:28 overlook named[6586]: success resolving 'ns0.ezdns.sx/AAAA' (in 'ezdns.sx'?) after reducing the advertised EDNS UDP packet size to 512 octets
Jun  3 03:29:29 overlook named[6586]: success resolving 'ns5.ezdns.ms/AAAA' (in 'ezdns.ms'?) after disabling EDNS
Jun  3 03:29:29 overlook named[6586]: success resolving 'ns2.ezdns.pl/A' (in 'ezdns.pl'?) after disabling EDNS
Jun  3 03:29:30 overlook named[6586]: success resolving 'ns0.ezdns.sx/AAAA' (in 'ezdns.sx'?) after disabling EDNS
Jun  3 03:29:30 overlook named[6586]: success resolving 'ns0.ezdns.yt/AAAA' (in 'ezdns.yt'?) after disabling EDNS
Jun  3 03:29:31 overlook named[6586]: success resolving 'ns0.ezdns.ms/AAAA' (in 'ezdns.ms'?) after disabling EDNS
Jun  3 03:29:33 overlook named[6586]: success resolving 'ns0.ezdns.ms/AAAA' (in 'ezdns.ms'?) after disabling EDNS

What can I do to prevent these logs from appearing? Why would this server be the only server that is causing BIND to produce these logs?

I've search around google and have found a few different solutions for hiding these logs, but I would like to know why this one server is so troublesome

share|improve this question
3  
I can't read the messages in your image. Cut and paste a few samples and you might get a better answer. –  Fred the Magic Wonder Dog Jun 3 at 3:56
1  
Not only is it hard to read but pictures of text are not searchable and not copy/paste friendly. –  Håkan Lindqvist Jun 3 at 5:11
    
@FredtheMagicWonderDog Hello, sorry about that. Had been concerned that the log excerpt was too large of an amount of text (thought that people would complain). I've updated the question with the actual text –  lacrosse1991 Jun 3 at 20:59
    
@HåkanLindqvist Hello, I've updated the question with the actual text. How did you extract the text from that picture by the way? (in the edit that you had made) –  lacrosse1991 Jun 3 at 21:00
    
@lacrosse1991 OCR –  Håkan Lindqvist Jun 3 at 22:00

1 Answer 1

Try to check if it's on your end that something is causing problems with DNS packets that are >512 bytes. This should not be the case but there are firewalls that incorrectly do not allow this.

If the problem does not consistently occur with large packets but only happens with some specific remote servers it would seem that the problem is outside your control.

There are the edns-udp-size (this specifies the largest packet you advertise that you can receive) and max-udp-size (this specifies the largest packet you will send) options. Both default to 4096. Lowering these will increase the likelyhood of truncated responses and fallback to TCP in their respective directions (one is more relevant for recursion, the other for authoritative).

However, it only really makes sense to change these settings if the problem is on your own end rather than if you have just run into some random remote server that has a problem. On the other hand, if the problem is on your end the best solution would typically be to fix the network device that causes the problem rather than configuring bind to limit the packet size.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.