Re: [cobalt-users] lame server

["Rick Ewart" <rick@xxxxxxxxx>]

Carrie wrote:
No, seriously. I am getting this "Unusual System Event" (below) in my logs
every few minutes. I have looked through the archives on this and no one
seemed to have been able to come up with what it may be - Dan had a guess
that maybe someone else's DNS was pointing the wrong way.
I was hoping someone might've figured it out by now.
-------------------

Hey Carrie.

I personally think its an attack on the server, of some sort, as I get
several a day. I figured they are trying to solicit info from our servers.
Note the log file from my machine at the same time.... Coincidence? I can't
believe it. There is a 2 minute difference between mine and yours.

I asked everyone about this before as I am trying to understand the various
messages I get from logcheck. The other one I get a lot are "bad referrals".

If anyone knows of a resource to learn about log messages, please let me
know - I have tried everywhere - redhat, cobalt, the archives, cert, etc....
no luck so far. Even my redhat book is useless.

Carrie's Log:
-----------------
Jan 30 12:40:32 www named[916]: Lame server on '19.66.241.207.in-addr.arpa'
(in '19.66.241.207.in-addr.arpa'?): [192.67.14.16].53 't.ns.verio.net'
Jan 30 12:40:32 www named[916]: Lame server on '19.66.241.207.in-addr.arpa'
(in '19.66.241.207.in-addr.arpa'?): [129.250.35.32].53 'b.ns.verio.net'
Jan 30 12:40:32 www named[916]: ns_forw: query(19.66.241.207.in-addr.arpa)
All possible A RR's lame

My Log:
-----------
Jan 30 12:37:58 www named[746]: Lame server on '12.66.241.207.in-addr.arpa'
(in '12.66.241.207.in-addr.arpa'?): [192.67.14.16].53 't.ns.verio.net'
Jan 30 12:37:58 www named[746]: Lame server on '12.66.241.207.in-addr.arpa'
(in '12.66.241.207.in-addr.arpa'?): [129.250.35.32].53 'b.ns.verio.net'


Rick Ewart