notify question section contains no SOA: 1 Time(s)

[Kevin Darcy]

N/A wrote:

> Hi,
>
> My Bind 9.2.1 servers have started sending me the above message via
> LogWatch. I won't be back in the office until the 6th, so I can't check the
> log files themselves. They've been up for several months but this just
> started a few days ago. Can anyone shed any light on what this might mean?

Well, basically it means what it says. NOTIFY packets usually contain an
SOA RR in their question section. You're getting NOTIFYs without any SOA. That
could mean some sort of packet truncation/corruption, or it could mean a
problem (e.g. bug, resource issue) with the master, such that it is sending
malformed NOTIFY packets. If the master is having those sorts of problems,
it's likely that zone transfers are failing too, so changes won't propagate.
Definitely something I'd check out ASAP.


- Kevin