On 04-May-01 at 03:55:43 Wei Jiang wrote:
> Apr 26 11:45:59 raw gnome-name-server[16003]: starting
> Apr 26 11:45:59 raw gnome-name-server[16003]: name server starting
> Apr 26 11:46:53 raw named[1784]: reloading nameserver
> Apr 26 11:46:53 raw named[1784]: Forwarding source address is
> [0.0.0.0].1361
>
> I am sure that the name server was never started manually.
>
I run KDE rather than gnome so I can't say what gnome does, but perhaps a
caching-only name server was installed. What does /etc/resolv.conf show (if
anything)?
> What's more, I noticed the following logs, which also appear serveral
> times a day:
> -------------------------------------------------------------------------
> NSTATS 988307486 987447347 A=2383 CNAME=92 SOA=320 MX=249 TXT=1 AAAA=12
> ANY=3
> Apr 26 13:51:26 raw named[1784]: XSTATS 988307486 987447347 RR=56 RNXD=0
> RFwdR=12 RDupR=2 RFail=0 RFErr=0 RErr=0 RAXFR=0 RLame=0 ROpts=0 SSysQ=42
> SAns=3136 SFwdQ=0 SDupQ=5 SErr=0 RQ=3134 RIQ=2 RFwdQ=0 RDupQ=0 RTCP=0
> SFwdR=12 SFail=0 SFErr=0 SNaAns=82 SNXD=4 RUQ=0 RURQ=0 RUXFR=0 RUUpd=0
>
These are just BIND statistics dumped out to the logs on a regular basis. If
you have a /etc/named.conf file, then it probably has a statistics option
(can't remember the exact name) in there telling bind to do this.
> Apr 26 14:51:26 raw named[1784]: Cleaned cache of 0 RRsets
>
As mentioned by someone else, this is just bind's housekeeping - not a
problem.
> Is this a sign that the BIND is being hacked?
>
No.
John.
------------------------------------------------------------------------
John Horne, University of Plymouth, UK Tel: +44 (0)1752 233914
E-mail: [EMAIL PROTECTED]
PGP key available from public key servers
_______________________________________________
Redhat-list mailing list
[EMAIL PROTECTED]
https://listman.redhat.com/mailman/listinfo/redhat-list
