On Tue, 23 Oct 2012 17:55:06 +0200 =?utf-8?B?TG/Dr2M=?= Minier <[email protected]> wrote: > Package: logcheck > Version: 1.3.15 > Severity: minor > Tags: patch > > Hi, > > Got this log from time to time in System Events: > Oct 23 13:48:16 pig2 named[28880]: success resolving > '26.0/25.218.183.203.in-addr.arpa/PTR' (in '0/25.218.183.203.in-addr.arpa'?) > after reducing the advertised EDNS UDP packet size to 512 octets > > Changing the regexp for the "(in '...'?)" part from: > ^[[:alpha:]]{3} [ :[:digit:]]{11} [._[:alnum:]-]+ named\[[0-9]+\]: success > resolving '[^[:space:]]+' \(in '[.[:alnum:]-]+'\?\) after (disabling > EDNS|reducing the advertised EDNS UDP packet size to 512 octets)$ > to: > ^[[:alpha:]]{3} [ :[:digit:]]{11} [._[:alnum:]-]+ named\[[0-9]+\]: success > resolving '[^[:space:]]+' \(in '[/.[:alnum:]-]+'\?\) after (disabling > EDNS|reducing the advertised EDNS UDP packet size to 512 octets)$ >
It's a shame no-one replied to this bug from 2012. A lot has changed in that time, and eg EDNS is now more common- i do remember seeing messages like this in the past, and adding locla rules, but i unless i am missing something i dont see these messages at all in journal or bind.log today, so perhaps this bug can be closed. (i may well be missing something - if these are in fact common then we should definitely filter them as there's not much you can do!)
