Hi, Robert. As I understand, something is calling rndc on your localhost. So you may try (untested by me):
Find rndc binary, mv rndc rndc.ORIG Replace rndc with script which will execute something like ps fax >> /tmp/rndc.log then exec rndc.ORIG with the same arguments. Then you will see who invoked your rndc. Don't forget to use full path to rndc.ORIG, as you will never know which current directory will be when your rndc replacement will be executed and what the value of PATH will be. On 25.08.2015 0:01, Robert Senger wrote: > Hi all, > > after upgrading from Debian Wheezy to Jessie, bind9 receives "rndc > reconfig" commands every 30 minutes. I've never seen this before. Some > of my own scripts run "rndc restart/reload" after fiddling with network > interfaces, but none of these is the source of the observed 30 minutes > interval. There are also no cron jobs. > > In the bind9 logs I see this: > > 24-Aug-2015 22:53:43.431 general: info: received control channel command > 'reconfig' > 24-Aug-2015 22:53:43.458 general: info: loading configuration from > '/etc/bind/named.conf' > ... [more than 350 lines reconfig log] > > Running tcpdump on the lo interface gives me this: > > root@prokyon:/etc/bind# tcpdump -i lo port 953 > tcpdump: verbose output suppressed, use -v or -vv for full protocol decode > listening on lo, link-type EN10MB (Ethernet), capture size 65535 bytes > 21:23:35.071602 IP localhost.48466 > localhost.953: Flags [S], seq > 3862717043, win 43690, options [mss 65495,sackOK,TS val 196635776 ecr > 0,nop,wscale 5], length 0 > 21:23:35.071699 IP localhost.953 > localhost.48466: Flags [S.], seq > 2391140312, ack 3862717044, win 43690, options [mss 65495,sackOK,TS val > 196635776 ecr 196635776,nop,wscale 5], length 0 > 21:23:35.071821 IP localhost.48466 > localhost.953: Flags [.], ack 1, win > 1366, options [nop,nop,TS val 196635776 ecr 196635776], length 0 > 21:23:35.075355 IP localhost.48466 > localhost.953: Flags [P.], seq 1:148, > ack 1, win 1366, options [nop,nop,TS val 196635777 ecr 196635776], length 147 > 21:23:35.075435 IP localhost.953 > localhost.48466: Flags [.], ack 148, win > 1399, options [nop,nop,TS val 196635777 ecr 196635777], length 0 > 21:23:35.115513 IP localhost.953 > localhost.48466: Flags [P.], seq 1:180, > ack 148, win 1399, options [nop,nop,TS val 196635787 ecr 196635777], length > 179 > 21:23:35.115583 IP localhost.48466 > localhost.953: Flags [.], ack 180, win > 1399, options [nop,nop,TS val 196635787 ecr 196635787], length 0 > 21:23:35.116084 IP localhost.48466 > localhost.953: Flags [P.], seq 148:320, > ack 180, win 1399, options [nop,nop,TS val 196635787 ecr 196635787], length > 172 > 21:23:35.116130 IP localhost.953 > localhost.48466: Flags [.], ack 320, win > 1433, options [nop,nop,TS val 196635787 ecr 196635787], length 0 > 21:23:37.092444 IP localhost.953 > localhost.48466: Flags [P.], seq 180:363, > ack 320, win 1433, options [nop,nop,TS val 196636281 ecr 196635787], length > 183 > 21:23:37.094097 IP localhost.48466 > localhost.953: Flags [F.], seq 320, ack > 363, win 1433, options [nop,nop,TS val 196636281 ecr 196636281], length 0 > 21:23:37.130367 IP localhost.953 > localhost.48466: Flags [.], ack 321, win > 1433, options [nop,nop,TS val 196636291 ecr 196636281], length 0 > 21:23:37.829134 IP localhost.953 > localhost.48466: Flags [F.], seq 363, ack > 321, win 1433, options [nop,nop,TS val 196636465 ecr 196636281], length 0 > 21:23:37.829288 IP localhost.48466 > localhost.953: Flags [.], ack 364, win > 1433, options [nop,nop,TS val 196636465 ecr 196636465], length 0 > > Is there a way to identify the source of these reconfig commands? It's > really annoying as it messes up the log with 350 useless lines every 30 > minutes. > > Thanks! > > Robert > > -- Konstantin Stefanov, Research Computing Center M.V Lomonosov Moscow State University _______________________________________________ Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list bind-users mailing list bind-users@lists.isc.org https://lists.isc.org/mailman/listinfo/bind-users
