Can some one help!

[Barry Margolin]

In article <930398697.145.80 at news.remarQ.com>,
Ed Willoughby <edw at knology.net> wrote:
>I have not been able to locate a good book on Bind & DNS from the local

You need to find a better store, or go to Amazon.com.  You should get the
book "DNS & BIND" by Albitz & Liu, published by O'Reilly.

>stores, so I have been relegated to using only the man bind doc's and
>Nicolai Langfeldt's DNS HOWTO v2.2 11 Feb 1999.
>(quite a helpful source http://metalab.unc.edu/mdw/HOWTO/DNS-HOWTO.html)
>
>Anyway,  now here is the problem..  Perhaps a pasted copy of the Linux log
>will best serve here:
>
>Sample 1.
>
>Jun 25 13:15:33 pcflight named[194]: starting
>Jun 25 13:15:33 pcflight named[194]: cache zone "" (IN) loaded (serial 0)
>Jun 25 13:15:33 pcflight named[194]: master zone "0.0.127.in-addr.arpa" (IN)
>loaded (serial 1999062301)
>Jun 25 13:15:33 pcflight named[194]: master zone "pcflight.com" (IN) loaded
>(serial 1999062302)
>Jun 25 13:15:33 pcflight named[194]: master zone "14.192.209.in-addr.arpa"
>(IN) loaded (serial 1999062301)

Were you really assigned this entire class C?  I suspect not.  You probably
shouldn't be doing your own reverse DNS, just your forward DNS.

>Jun 25 13:15:33 pcflight named[194]: listening on [127.0.0.1].53 (lo)
>Jun 25 13:15:33 pcflight named[194]: listening on [192.168.0.1].53 (eth0)
>Jun 25 13:15:33 pcflight named[194]: listening on [209.192.14.68].53 (eth1)
>Jun 25 13:15:33 pcflight named[194]: Forwarding source address is
>[0.0.0.0].1024
>Jun 25 13:15:33 pcflight named[198]: Ready to answer queries.
>Jun 25 13:15:40 pcflight lpd[240]: restarted
>Jun 25 13:15:41 pcflight named[198]: sysquery: findns error (NXDOMAIN) on
>dns1.knology.net.14.192.209.in-addr.arpa?
>Jun 25 13:15:47 pcflight /usr/sbin/cron[281]: (CRON) STARTUP (fork ok)
>Jun 25 13:16:06 pcflight named[198]: Sent NOTIFY for "pcflight.com IN SOA"
>(pcflight.com); 1 NS, 1 A
>
>Don't understand the log entry at 13:15:41 and also the one at 13:16:06 gets
>sent quit often and I have not made changes to any of the named files..

The 13:15:41 message is because you left the "." off at the end of the
line:

    IN NS dns1.knology.net.

Any name without a "." at the end has the current origin (which defaults to
the domain of the zone file) appended to it.

The 13:16:06 message means that your master server notified the slave
server that you had made a change to your pcflight.com domain, to let it
know that it should perform a zone transfer.  This is normal.

>Sample 2.
>
>Jun 26 04:23:48 pcflight named[198]: Cleaned cache of 2 RRs
>Jun 26 04:23:48 pcflight named[198]: USAGE 930385428 930335028
>CPU=0.59u/0.37s CHILDCPU=0u/0s
>Jun 26 04:23:48 pcflight named[198]: NSTATS 930385428 930335028 A=307 PTR=11
>MX=3 ANY=6
>Jun 26 04:23:48 pcflight named[198]: XSTATS 930385428 930335028 RR=333
>RNXD=62 RFwdR=248 RDupR=1 RFail=0 RFErr=0 RErr=1 RAXFR=0 RLame=13 ROpts=0
>SSysQ=57 SAns=82 SFwdQ=203 SDupQ=90 SErr=0 RQ=327 RIQ=0 RFwdQ=0 RDupQ=47
>RTCP=0 SFwdR=248 SFail=0 SFErr=0 SNaAns=63 SNXD=5
>Jun 26 04:43:46 pcflight -- MARK --
>Jun 26 05:03:46 pcflight -- MARK --
>Jun 26 05:23:46 pcflight -- MARK --
>Jun 26 05:23:48 pcflight named[198]: Cleaned cache of 1 RR
>Jun 26 05:23:48 pcflight named[198]: USAGE 930389028 930335028
>CPU=0.6u/0.37s CHILDCPU=0u/0s
>Jun 26 05:23:48 pcflight named[198]: NSTATS 930389028 930335028 A=311 PTR=11
>MX=3 ANY=6
>Jun 26 05:23:48 pcflight named[198]: XSTATS 930389028 930335028 RR=337
>RNXD=66 RFwdR=252 RDupR=1 RFail=0 RFErr=0 RErr=1 RAXFR=0 RLame=13 ROpts=0
>SSysQ=57 SAns=82 SFwdQ=207 SDupQ=90 SErr=0 RQ=331 RIQ=0 RFwdQ=0 RDupQ=47
>RTCP=0 SFwdR=252 SFail=0 SFErr=0 SNaAns=63 SNXD=5
>Jun 26 05:43:46 pcflight -- MARK --
>Jun 26 06:03:46 pcflight -- MARK --
>Jun 26 06:23:46 pcflight -- MARK --
>Jun 26 06:23:48 pcflight named[198]: Cleaned cache of 1 RR
>Jun 26 06:23:48 pcflight named[198]: USAGE 930392628 930335028
>CPU=0.61u/0.37s CHILDCPU=0u/0s
>Jun 26 06:23:48 pcflight named[198]: NSTATS 930392628 930335028 A=315 PTR=11
>MX=3 ANY=6
>Jun 26 06:23:48 pcflight named[198]: XSTATS 930392628 930335028 RR=341
>RNXD=70 RFwdR=256 RDupR=1 RFail=0 RFErr=0 RErr=1 RAXFR=0 RLame=13 ROpts=0
>SSysQ=57 SAns=82 SFwdQ=211 SDupQ=90 SErr=0 RQ=335 RIQ=0 RFwdQ=0 RDupQ=47
>RTCP=0 SFwdR=256 SFail=0 SFErr=0 SNaAns=63 SNXD=5
>
>Now just last night this entry at 04:43:46 started and is repeating its
>self...  I cant find reference to either of these problems in anything I
>have read so far...  I need help!!!

The "-- Mark --" messages have nothing to do with DNS.  They come from a
cron job that sends this log message every 15 minutes, just to let you know
that cron and syslog are still working when the system is otherwise idle.

>Also how do I stop these entries going into the /var/log/messages log and
>perhaps redirect the out put to a new log file and have it automatically
>print it's display in one of the Logon screens..

If you're using BIND 8, you can modify the syslog facility code in the
"logging" statement of /etc/named.conf, perhaps to send named's log
messages using facility "local0".  Then you can configure /etc/syslog.conf
to write local0.* messages to a separate file.

More information about configuring this can be found in the book I
mentioned above.

-- 
Barry Margolin, barmar at bbnplanet.com
GTE Internetworking, Powered by BBN, Burlington, MA
*** DON'T SEND TECHNICAL QUESTIONS DIRECTLY TO ME, post them to newsgroups.
Please DON'T copy followups to me -- I'll assume it wasn't posted to the group.