CentOS FORMERR resolving message

Speedy

Speedy

Speedy

Associate
Joined
19 Dec 2007
Posts
277
Location
The Netherlands
I have a web server which is running CentOS 5. The website uses some Facebook API elements. I usually get this error message multiple times a day in /var/log/messages:
Code: 
Jul 19 11:07:31 server named[3064]: FORMERR resolving 'api-read.facebook.com/AAAA/IN': 69.63.185.78#53
Jul 19 11:07:31 server named[3064]: FORMERR resolving 'api-read.facebook.com/AAAA/IN': 69.63.185.11#53
Jul 19 11:07:31 server named[3064]: FORMERR resolving 'api-read.facebook.com/AAAA/IN': 69.63.191.91#53
Jul 19 11:07:31 server named[3064]: FORMERR resolving 'api-read.facebook.com/AAAA/IN': 69.63.179.22#53
Jul 19 11:07:31 server named[3064]: FORMERR resolving 'api-read.facebook.com/AAAA/IN': 69.63.185.86#53
Jul 19 11:07:32 server named[3064]: FORMERR resolving 'api-read.facebook.com/AAAA/IN': 69.63.176.101#53
Jul 19 11:07:32 server named[3064]: FORMERR resolving 'api-read.facebook.com/AAAA/IN': 69.63.191.219#53
Jul 19 11:07:32 server named[3064]: FORMERR resolving 'api-read.facebook.com/AAAA/IN': 69.63.191.219#53
Jul 19 11:07:32 server named[3064]: FORMERR resolving 'api-read.facebook.com/AAAA/IN': 69.63.191.91#53
Jul 19 11:07:32 server named[3064]: FORMERR resolving 'api-read.facebook.com/AAAA/IN': 69.63.185.11#53
Jul 19 11:07:32 server named[3064]: FORMERR resolving 'api-read.facebook.com/AAAA/IN': 69.63.185.78#53
Jul 19 11:07:32 server named[3064]: FORMERR resolving 'api-read.facebook.com/AAAA/IN': 69.63.179.22#53
Jul 19 11:07:32 server named[3064]: FORMERR resolving 'api-read.facebook.com/AAAA/IN': 69.63.176.101#53
Jul 19 11:07:32 server named[3064]: FORMERR resolving 'api-read.facebook.com/AAAA/IN': 69.63.185.86#53
Jul 19 11:07:32 server named[3064]: FORMERR resolving 'api-read.facebook.com/AAAA/IN': 69.63.191.219#53
Jul 19 11:07:32 server named[3064]: FORMERR resolving 'api-read.facebook.com/AAAA/IN': 69.63.191.91#53
Jul 19 11:07:33 server named[3064]: FORMERR resolving 'api-read.facebook.com/AAAA/IN': 69.63.185.11#53
Jul 19 11:07:33 server named[3064]: FORMERR resolving 'api-read.facebook.com/AAAA/IN': 69.63.185.78#53
Jul 19 11:07:33 server named[3064]: FORMERR resolving 'api-read.facebook.com/AAAA/IN': 69.63.176.101#53
Jul 19 11:07:33 server named[3064]: FORMERR resolving 'api-read.facebook.com/AAAA/IN': 69.63.179.22#53
Jul 19 11:07:33 server named[3064]: FORMERR resolving 'api-read.facebook.com/AAAA/IN': 69.63.185.86#53
Jul 19 11:07:33 server named[3064]: FORMERR resolving 'api-read.facebook.com/AAAA/IN': 69.63.191.219#53
Jul 19 11:07:33 server named[3064]: FORMERR resolving 'api-read.facebook.com/AAAA/IN': 69.63.191.91#53
Jul 19 11:07:33 server named[3064]: FORMERR resolving 'api-read.facebook.com/AAAA/IN': 69.63.185.11#53
Jul 19 11:07:34 server named[3064]: FORMERR resolving 'api-read.facebook.com/AAAA/IN': 69.63.185.78#53
Jul 19 11:07:34 server named[3064]: FORMERR resolving 'api-read.facebook.com/AAAA/IN': 69.63.179.22#53
Jul 19 11:07:34 server named[3064]: FORMERR resolving 'api-read.facebook.com/AAAA/IN': 69.63.176.101#53
Jul 19 11:07:34 server named[3064]: FORMERR resolving 'api-read.facebook.com/AAAA/IN': 69.63.185.86#53
What does this mean and what can I do about it?
 
Are you running a local DNS bind server?

Those errors basically mean a DNS request was in an invalid format.

The AAAA/IN on the end of the address suggests it's an IPv6 lookup.

If you lookup the facebook site for AAAA record:
Code: 
[jack@tmob ~]$ dig api-read.facebook.com/AAAA/IN

; <<>> DiG 9.6.1 <<>> api-read.facebook.com/AAAA/IN
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 11853
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;api-read.facebook.com/AAAA/IN.	IN	A

;; ANSWER SECTION:
api-read.facebook.com/AAAA/IN. 0 IN	A	67.215.65.132

;; Query time: 57 msec
;; SERVER: 192.168.1.254#53(192.168.1.254)
;; WHEN: Mon Jul 19 13:31:00 2010
;; MSG SIZE  rcvd: 63

You can see Facebook don't have IPv6, and return a IPv4 address causing an invalid format packet (I think).

At a wild stab in the dark, try turning off IPv6 and see if they go away or ignore the problem.
 
I'm indeed running bind9 on my server. But now I've disabled IPv6, now just waiting if the error message occurs again. Thanks for your help :)
 
You must log in or register to reply here.
Back
Top Bottom