[Gllug] NAMED log file entry

Ken Smith kens at kensnet.org
Wed Feb 18 06:49:46 UTC 2004

Hi Ian,

Thanks that fixed it. I am using MailScanner which was referring to
relays.monkeys.com on its RBL list.

All the best


-----Original Message-----
From: Ian Northeast [mailto:ian at house-from-hell.demon.co.uk] 
Sent: 16 February 2004 20:59
To: kens at kensnet.org; Greater London Linux Users Group
Subject: Re: [Gllug] NAMED log file entry

Ken Smith wrote:
> Folks, Here is an extract from the logfile of a RH 7.3 machine. Anyone
> seeing these messages from BIND?
> I have monitored my network with ethereal and don't see any untoward
> traffic.
> Suggestions welcome
> Ken
> --------------------- Named Begin ------------------------ 
> **Unmatched Entries**
>    internal_send: Invalid argument: 545 Time(s)

As it happens someone asked this very question on the bind mailing list 
the other day. Here is the answer from Mark Andrews of the ISC:

 > This is becoming a FAQ.

 > You have a client trying to lookup relays.monkeys.com (a dead
 > anti-spam
 > list) which has a bad server with a CLASS E addressess.

 > * Mark the server as bogus.
 > * Fix the broken MTA generating the queries.

 > Mark

 > server {
 >         bogus yes;
 > };

If you want to find out what machine is generating these queries, turn 
query logging on in your nameserver (send it a WINCH signal). By the 
look of it you won't need to leave it on for long.

Regards, Ian

Gllug mailing list  -  Gllug at gllug.org.uk

More information about the GLLUG mailing list