In /var/log/messages there are lot of
rsyslogd-2177: imuxsock begins to drop messages from pid xxxxx due to rate-limiting
rsyslogd-2177: imuxsock lost xxx messages from pid xxxxx due to rate-limiting
and nothing about bind/named.
But now I can tell that bind is restarted by vps hoster:
"The process named is potential ddos risk. 100% CPU Time ddos Bug with dns cache and libdns on some versions".
Anyway, thank you. (-: