topic Re: Entries in /var/log/messages in Operating System - Linux

Entries in /var/log/messages

R.O. — Mon, 21 Apr 2003 13:19:24 GMT

Hi all,

I have a dns server running linux red hat 7.1 and in /var/log/messages are hundreds of entries like this:

Apr 21 15:52:00 server1 named[1162]: client 1xx.xx.xx.xx#1287: no matching view in class 'CLASS256'.

I found in google the following:

"It means you've got a broken client that doesn't construct proper DNS
queries. This client is using an undefined and invalid class number
for its queries (256) instead of IN - class 1 - which is pretty much
the only valid class for DNS queries. You can ignore the message, but
it would be better to get proper DNS software on the client that's
making these faulty requests."

I think these malformed queries are doing by pcs running windows, but i want to know how this issue can be fixed and if it is possible that these queries provoke a performance problem in the dns server.

Thanks and kind regards

Re: Entries in /var/log/messages

Sergejs Svitnevs — Tue, 22 Apr 2003 04:43:51 GMT

Try to change the "logging" Statement Definition in /etc/named.conf

logging {
category "unmatched" { "null"; };
};

Regards,
Sergejs

Re: Entries in /var/log/messages

Sergejs Svitnevs — Tue, 22 Apr 2003 04:44:58 GMT

Try to change the "logging" Statement Definition in /etc/named.conf

logging {
category "unmatched" { "null"; };
};

Regards,
Sergejs

Re: Entries in /var/log/messages

Sergejs Svitnevs — Tue, 22 Apr 2003 04:45:47 GMT

Try to change the "logging" Statement Definition in /etc/named.conf

logging {
category "unmatched" { "null"; };
};

Regards,
Sergejs

Re: Entries in /var/log/messages

Sergejs Svitnevs — Tue, 22 Apr 2003 04:47:52 GMT

Try to change the "logging" Statement Definition in /etc/named.conf

logging {
category "unmatched" { "null"; };
};

Regards,
Sergejs

Re: Entries in /var/log/messages

Bryan Hunter_1 — Tue, 02 Sep 2003 14:43:40 GMT

I have traced the invalid classes to requests for WWW.N3T.COM.BR. These are from the Opasoft (Opaserv) worm virus. I specifically observed CLASS256 & CLASS29540 requesting WWW.N3T.COM.BR from an Opasoft (Opaserv) worm virus (Brasil variant?) infected machine.