DNS Weirdness

  • Thread starter Thread starter Barkmull
  • Start date Start date
B

Barkmull

Hello Everyone,

I am getting a large amount (about 10 every hour) of the following event
IDs:

Source: DNS Event: 5504
Source: DNS Event: 3150

The IP addresses listed in the 5504 events are all from my root hints (e.g.
x.root-server.net).

I have two Active Directory integrated zones and two standard primary zones
(child domains).
They are all set to allow dynamic updates (the AD integrated ones only
secure updates).
The SOA for all DNS servers is the primary Active Directory Integrated zone.

The event id: 3150 is caused by the SOA record being incremented
continously on the primary Active Directory integrated zone. It jumps up a
couple of increments about every hour. I find this very odd. Does anyone
have any idea why it is doing this? I am not that well versed in DNS but it
sure looks funny to me.

Also, under the properties of the primary Active Directory SOA record, the
"Responsible Person" field is always filled with garbage ascii characters.
If I change it to something it will be replaced with garbage text the next
time the 3150 event is logged (i.e. it wrote a new version of the zone).

Any feedback or ideas would be greatly appriciated!

Happy New Year!

-B
 
In
Barkmull said:
Hello Everyone,

I am getting a large amount (about 10 every hour) of the following
event IDs:

Source: DNS Event: 5504
Source: DNS Event: 3150

The IP addresses listed in the 5504 events are all from my root hints
(e.g. x.root-server.net).

I have two Active Directory integrated zones and two standard primary
zones (child domains).
They are all set to allow dynamic updates (the AD integrated ones only
secure updates).
The SOA for all DNS servers is the primary Active Directory
Integrated zone.

The event id: 3150 is caused by the SOA record being incremented
continously on the primary Active Directory integrated zone. It
jumps up a couple of increments about every hour. I find this very
odd. Does anyone have any idea why it is doing this? I am not that
well versed in DNS but it sure looks funny to me.

Also, under the properties of the primary Active Directory SOA
record, the "Responsible Person" field is always filled with garbage
ascii characters. If I change it to something it will be replaced
with garbage text the next time the 3150 event is logged (i.e. it
wrote a new version of the zone).

Any feedback or ideas would be greatly appriciated!

Happy New Year!

-B
Click to expand...

5504's mean that one of your machines probably has either and underscore or
space, or some other illegal character in it's hostname.
http://www.eventid.net/display.asp?eventid=5504&source=

3150's are benign:
http://www.eventid.net/display.asp?eventid=3150&source=


--
Regards,
Ace

Please direct all replies to the newsgroup so all can benefit.
This posting is provided "AS IS" with no warranties.

Ace Fekay, MCSE 2000, MCSE+I, MCSA, MCT, MVP
Microsoft Windows MVP - Active Directory
 
Back
Top