[lug] Lame server on?

[John Hernandez]

Paul Bille wrote:

> Can someone tell me what "Lame server on" means?  Please refer to the
> snippet from the log file below.  The problem appears to be on a remote
> system so I'm not particularly concerned but I am curious.  Last week I
> had a few mail messages addressed to "navigator.org" which apparently
> has a "Lame server".  Sendmail tried and tried again to get an MX
> record, filling my log file with extraneous error messages.  I finally
> had to delete the errant mail messages.
>


It means that they have a ns record pointing to a server that isn't 
actually authoratative for the domain.  If they are your friends, you 
might want to let them know.


> Also, what is the "/sbin/rmmod -as" process that runs every 10 minutes?
> Is it necessary to log it?  Is there any way I can control the logging
> for this process.
> 


You could probably find it in crontab or anacron config and change it 
to something like:

/sbin/rmmod -as > /dev/null 2>&1


> Is there any significance to named cleaning the cache hourly?  Once
> again is it necessary to log it?
> 


It can be useful information if you're debugging named, but otherwise 
you probably don't care.


> I had a LINUX 6.2 system hacked with a bind v8.2x overflow this spring.
> It's possible that I might have minimized the damage if the log file
> contained less extraneous information and the security breach stood out.
> 


Rather than log less, I would recommend that you use a program like 
Psionic's logcheck to filter out the background noise and send you an 
e-mail when something looks important.

http://www.psionic.com/abacus/logcheck/


> Thanks for your help,
> 
> Paul
> http://bille.cudenver.edu/author
> 
> Dec  5 15:03:41 liz named[523]: Lame server on '33.6.5.144.in-addr.arpa'
> (in '5.144.in-addr.arpa'?): [198.83.47.48].53 'DNS2-T.ANS.NET'
> Dec  5 15:10:00 liz CROND[19425]: (root) CMD (   /sbin/rmmod -as)
> Dec  5 15:20:00 liz CROND[19430]: (root) CMD (   /sbin/rmmod -as)
> Dec  5 15:30:00 liz CROND[19435]: (root) CMD (   /sbin/rmmod -as)
> Dec  5 15:37:34 liz named[523]: Cleaned cache of 19 RRsets
> Dec  5 15:37:43 liz named[523]: USAGE 1007591863 1006923994
> CPU=16.51u/7.57s CHILDCPU=0u/0s
> Dec  5 15:37:43 liz named[523]: NSTATS 1007591863 1006923994 A=5596 NS=1
> PTR=2297 MX=267 ANY=3029
> Dec  5 15:37:43 liz named[523]: XSTATS 1007591863 1006923994 RR=5109
> RNXD=405 RFwdR=2435 RDupR=9 RFail=3 RFErr=0 RErr=1 RAXFR=0 RLame=1451
> ROpts=0 SSysQ=1201 SAns=7839 SFwdQ=2766 SDupQ=2187 SErr=0 RQ=11190 RIQ=0
> RFwdQ=0 RDupQ=674 RTCP=1 SFwdR=2435 SFail=0 SFErr=0 SNaAns=7101
> SNXD=1491
> 
> 
> _______________________________________________
> Web Page:  http://lug.boulder.co.us
> Mailing List: http://lists.lug.boulder.co.us/mailman/listinfo/lug
> 


-- 

   - John Hernandez - Network Engineer - 303-497-6392 -
  |  National Oceanic and Atmospheric Administration   |
  |  Mailstop R/OM12. 325 Broadway, Boulder, CO 80305  |
   ----------------------------------------------------