Re: [cobalt-users] High load on Cobalt raq4

[Bill Campbell <bill@xxxxxxxxxxxxx>]

On Mon, Dec 30, 2002 at 07:56:18PM -0500, cbtrussell wrote:
>> While checking the /var/log/messages file i found at
>> that moment the log is showing the type of
>> errors as follows:
>>
>> Dec 30 09:09:18 server named[1201]: denied update from
>> [61.11.60.37].10739 for "
>> abc.com"
...
>>
>> 2/3 days back the similar incident happened, and the
>> errors that time also showing the same as
>> above.
>> Can anyone help me out? How can i control our server
>> load from this type of login which is
>> creating more load on our server?
>
>Hello,
>
>Those are messages from the bind DNS service, running as user named. Nothing
>to do with Apache. I don't think these failed requests have any material
>impact on the load on your server. I'd just ignore them.

I'm not sure I would totally ignore them since it appears to be an attempt
to update your DNS server from an outsider, probably someplace in the far
east.  If they try DNS, they may well try other vulnerable ports (BIND
seems to have taken over from sendmail as the primary vector for root
attacks on *ix servers).

Bill
--
INTERNET:   bill@xxxxxxxxxxxxx  Bill Campbell; Celestial Software LLC
UUCP:               camco!bill  PO Box 820; 6641 E. Mercer Way
FAX:            (206) 232-9186  Mercer Island, WA 98040-0820; (206) 236-1676
URL: http://www.celestial.com/

``The children who know how to think for themselves spoil the harmony of
the collective society that is coming, where everyone would be
interdependent.''  1899 John Dewey, educational philosopher, proponent of
modern public schools.