<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 TRANSITIONAL//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; CHARSET=UTF-8">
<META NAME="GENERATOR" CONTENT="GtkHTML/3.28.3">
</HEAD>
<BODY>
On Wed, 2012-10-10 at 18:44 +0000, Evan Hunt wrote:
<BLOCKQUOTE TYPE=CITE>
<PRE>
> BIND 9.7.7, 9.8.4 and 9.9.2 have "improved" OpenSSL error logging.
> Unfortunately, our logs are now filling up with "RSA_verify failed"
> messages.
Yeah, oops, we made that one too noisy. You're not the first one
who's noticed. :/
> How does one go about tracking down the source of these failures and
> correcting them? (We are running OpenSSL 1.0.1c.)
In BIND9, in lib/dns/opensslrsa_link.c, change this:
return (dst__openssl_toresult2("RSA_verify",
DST_R_VERIFYFAILURE));
to this:
return (dst__openssl_toresult(DST_R_VERIFYFAILURE));
</PRE>
</BLOCKQUOTE>
<BR>
Evan, After applying this change the logs still fill up with some crud (9.9.2)<BR>
<BR>
now still fills up with <BR>
<BR>
Oct 12 04:13:46 ns1 named[18293]: sucessfully validated after lower casing signer 'US'<BR>
Oct 12 04:36:35 ns1 named[18293]: sucessfully validated after lower casing signer 'CO'<BR>
Oct 12 04:36:35 ns1 last message repeated 4 times<BR>
...<BR>
<BR>
<BR>
any method to disable this? Is it in its own category we can null out without affecting any other logging?<BR>
<BR>
Cheers<BR>
<BR>
</BODY>
</HTML>