On Tue, Jan 08, 2008 at 12:02:04AM -0800, Gary Kline wrote:
> On Mon, Jan 07, 2008 at 11:13:45AM +0000, Matthew Seaman wrote:
> > -----BEGIN PGP SIGNED MESSAGE-----
> > Hash: SHA256
> > 
> > Gary Kline wrote:
> > 
> > >>  Then I checked my /etc/namedb/s/db.thought.org to see id anything there 
> > >>  could conceivably be hanging port 25.  Zip.  (I still updated the
> > >>  date and re-exed. I checked with ps and grep to find something new:
> > 
> > The best way to check for any processes listening on port 25 is:
> > 
> > % sockstat | grep :25 
> > root     sendmail   1193  3  tcp4   81.187.76.162:25      *:*
> > root     sendmail   1193  5  tcp4   127.0.0.1:25          *:*
> > root     sendmail   1193  6  tcp6   ::1:25                *:*
> > root     sendmail   1193  7  tcp6   2001:8b0:151:1:240:5ff:fea5:8db7:25*:*
> > 
> 
> matthew, i did sockstat|gr 3, 4 da aago; couldn't make sense-of.  here's what 
> i get for sendmail and the above.   i can't make sense ofthis::
> 
> p1 23:52 <sage> [5001] pss                                                    
> ~
> 1380  ??  Is     0:00.20 sendmail: Queue [EMAIL PROTECTED]:30:00 for 
> /var/spool/client
> 1382  ??  Ss     0:16.25 sendmail: accepting connections (sendmail)
> 14646  ??  I      0:00.02 sendmail: server 131.sub-75-212-161.myvzw.com 
> [75.212
> p1 23:53 <sage> [5002] sockstat | grep :25                                    
> ~
> root     sendmail   14646 1  tcp4   216.231.43.140:25     75.212.161.131:1416
> root     sendmail   14646 4  tcp4   216.231.43.140:25     75.212.161.131:1416
> root     sendmail   14646 7  tcp4   216.231.43.140:25     75.212.161.131:1416
> root     sendmail   1382  4  tcp4   *:25                  *:*
> 
> 
> you'll prob'ly be up in a few hours, but it's time for me to cop a few z's 
> 8 tz's west of you..... thus, t'mmrw.
> 
> gary
> 
> 
> 
> > >>                    ~
> > >> 624  ??  Ss     0:01.16 /usr/sbin/syslogd -l /var/run/log -l 
> > >> /var/named/var/r
> > >> p0 0:27 <sage> [5005]
> > > 
> > >>  In theory I know pretty much what bind9does, &c; but why this
> > >>  change?  (Part of my gnome (2.20) is missing so I cannot max
> > >>  enlarge the konsole; ps -alx does not wrap so I cant see the 
> > >>  entire string.)  I can pimg ns1.thought.org--obviously.  But if you
> > >>  see anything here,  Matthew, would you please let me know?
> > 
> > To get ps output without truncation, simply add 'ww' to the flags --
> > one 'w' gives you a 132 column output (shades of those old fan-fold line
> > printer TTYs there) and two (or more) 'w's gives you unlimited width:
> > 
> > # ps -alx | grep /usr/sbin/s
> >     0   689     1   0  44  0  3188  1240 select Ss    ??    0:07.28 
> > /usr/sbin/s
> >     0  1188     1   0  44  0  5640  3356 select Is    ??    0:00.02 
> > /usr/sbin/s
> > # ps -alxww | grep /usr/sbin/s
> >     0   689     1   0  44  0  3188  1240 -      Rs    ??    0:07.29 
> > /usr/sbin/syslogd -l /var/run/log -l /var/named/var/run/log -a 
> > 81.187.76.161/32:4096 -l /var/named/var/run/log
> >     0  1188     1   0  44  0  5640  3356 select Is    ??    0:00.02 
> > /usr/sbin/sshd
> >  1001 16014  1376   0  44  0   380   260 -      R+    p0    0:00.00 grep 
> > /usr/sbin/s
> > 
> > As for the presence of '-l /var/named/var/run/log' -- that's added
> > to the syslogd flags automatically by the /etc/rc.d/syslogd startup
> > script[*] if you're running named chrooted (which is the default). This
> > means that syslogd can log the items outside the chroot that are generated
> > by named within it.  You should see output from named in /var/log/all.log
> > - -- precisely what you see depends entirely on the logging configuration
> > in named.conf.
> > 
> >     Cheers,
> > 
> >     Matthew
> > 
> > [*] The reason I have it twice is that a long time ago I'd also added
> > it to syslogd_flags manually, something I shall correct imminently.
> > 


        I have a script here that sends test mail to various servers on 
thought.org.  I just caught this returned mail from qmail here.  

        From this, it loooks as though though.org has disappeared entirely::


<[EMAIL PROTECTED]>: host ns1.thought.org[216.231.43.140] said: 553 5.1.2
<[EMAIL PROTECTED]>... Unrecognized host name magnesium.net. (in reply to
MAIL FROM command)

        Or is this thought.org that is not seeing magnesium.net?!  Either
        way, and whatever else is going on, could my /etc/namedb/*/*
        files be involved in this mess?  bind9 is one thing I simply
        do not touch. Or if/when (abs) necessary, I treat this stuff
        like nitroglycerine:)

        gary



Gary Kline  Seattle BSD Users' Group (seabug)      | [EMAIL PROTECTED]
            Thought Unlimited Org's Alternate Email Site
            http://www.magnesium.net/~kline
   To live is not a necessity; but to live honorably...is a necessity. -Kant

_______________________________________________
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to "[EMAIL PROTECTED]"

Reply via email to