Table of Contents
Lire supports query logs of two DNS servers: Bind 8™ and Bind 9™.
You have to enable query logging in bind, something which is not turned on by default.
Example 8.1. Enabling Query Log In Bind
To enable query logging in Bind 8™ or Bind 9™, you should add the following to your named.conf configuration file:
logging {
channel query_logging {
file "/var/log/named_querylog"
versions 3 size 100M;
print-time yes; // timestamp log entries
};
category queries {
query_logging;
};
};
Bind 8™'s query logs contain one entry for each DNS query made to the name server. It logs the time of the query (you have to set print-time to yes for this), the IP of the requesting client, the name queried, the type of the query and the protocol. Recursive queries will have a + after the XX which appears in all query entries.
Bind 9™ logs the same information as Bind 8™ (except whether the request was recursive or not) but in a different format.
We also support the new date format introduced in Bind9 9.3 which also contains the year (15-Jul-2002).
Example 8.3. Sample Bind 9™ Query Log
print-severity and print-category were set to yes to obtain that log. Lire also accepts logs where those are turned off.
Feb 25 11:09:43.651 queries: info: client 10.0.0.3#1035: \
query: 3.example.com.nl IN A
Feb 25 11:09:48.739 queries: info: client 10.0.0.3#1035: \
query: 3.example.com.nl IN A
Feb 25 12:50:32.476 queries: info: client 10.0.0.3#1035: \
query: 21.example.com.co.uk IN A
Feb 25 12:50:34.110 queries: info: client 10.0.0.3#1035: \
query: 22.example.com IN A
If you miss the recursive flag from Bind 8™, it is possible to add back that feature by patching Bind 9™. The following patch by by Wytze van der Raay will add a + or - after the query type to indicate whether the query was recursive or not. Lire will detect that the log file was made by a patched Bind 9™.
# patch bin/named/query.c to log recursive/non-recursive query indication
SRC=bin/named/query.c
if [ -f ${SRC}.org ]
then
echo "Patched ${SRC} already in place"
else
echo "Patch ${SRC} for recursive/non-recursive query indication"
cp -p ${SRC} ${SRC}.org
patch -p0 ${SRC} <<\!
--- bin/named/query.c.org Mon Sep 24 22:57:48 2001
+++ bin/named/query.c Tue Sep 25 09:55:21 2001
@@ -3272,7 +3272,8 @@
dns_rdatatype_format(rdataset->type, typename, sizeof(typename));
ns_client_log(client, NS_LOGCATEGORY_QUERIES, NS_LOGMODULE_QUERY,
- level, "query: %s %s %s", namebuf, classname, typename);
+ level, "query: %s %s %s%s", namebuf, classname, typename,
+ WANTRECURSION(client) ? "+" : "-");
}
void
!
fi