44

I am trying to find the perfect logging clause in named.conf that would help me enable full-level logs for named service. Can someone give an example here? My current clause is given below, but this generates very minimal logs.

 logging {
     channel querylog{
             file "/var/log/querylog";
             severity debug 10;
             print-category yes;
             print-time yes;
             print-severity yes;
             };
     category queries { querylog;};
 };
Jeff Ferland
  • 16,762
  • 5
  • 42
  • 72
deppfx
  • 661
  • 1
  • 10
  • 22

2 Answers2

87

I usually expand each log out into it's own channel and then to a separate log file, certainly makes things easier when you are trying to debug specific issues. So my logging section looks like the following:

logging {
    channel default_file {
        file "/var/log/named/default.log" versions 3 size 5m;
        severity dynamic;
        print-time yes;
    };
    channel general_file {
        file "/var/log/named/general.log" versions 3 size 5m;
        severity dynamic;
        print-time yes;
    };
    channel database_file {
        file "/var/log/named/database.log" versions 3 size 5m;
        severity dynamic;
        print-time yes;
    };
    channel security_file {
        file "/var/log/named/security.log" versions 3 size 5m;
        severity dynamic;
        print-time yes;
    };
    channel config_file {
        file "/var/log/named/config.log" versions 3 size 5m;
        severity dynamic;
        print-time yes;
    };
    channel resolver_file {
        file "/var/log/named/resolver.log" versions 3 size 5m;
        severity dynamic;
        print-time yes;
    };
    channel xfer-in_file {
        file "/var/log/named/xfer-in.log" versions 3 size 5m;
        severity dynamic;
        print-time yes;
    };
    channel xfer-out_file {
        file "/var/log/named/xfer-out.log" versions 3 size 5m;
        severity dynamic;
        print-time yes;
    };
    channel notify_file {
        file "/var/log/named/notify.log" versions 3 size 5m;
        severity dynamic;
        print-time yes;
    };
    channel client_file {
        file "/var/log/named/client.log" versions 3 size 5m;
        severity dynamic;
        print-time yes;
    };
    channel unmatched_file {
        file "/var/log/named/unmatched.log" versions 3 size 5m;
        severity dynamic;
        print-time yes;
    };
    channel queries_file {
        file "/var/log/named/queries.log" versions 3 size 5m;
        severity dynamic;
        print-time yes;
    };
    channel network_file {
        file "/var/log/named/network.log" versions 3 size 5m;
        severity dynamic;
        print-time yes;
    };
    channel update_file {
        file "/var/log/named/update.log" versions 3 size 5m;
        severity dynamic;
        print-time yes;
    };
    channel dispatch_file {
        file "/var/log/named/dispatch.log" versions 3 size 5m;
        severity dynamic;
        print-time yes;
    };
    channel dnssec_file {
        file "/var/log/named/dnssec.log" versions 3 size 5m;
        severity dynamic;
        print-time yes;
    };
    channel lame-servers_file {
        file "/var/log/named/lame-servers.log" versions 3 size 5m;
        severity dynamic;
        print-time yes;
    };

    category default { default_file; };
    category general { general_file; };
    category database { database_file; };
    category security { security_file; };
    category config { config_file; };
    category resolver { resolver_file; };
    category xfer-in { xfer-in_file; };
    category xfer-out { xfer-out_file; };
    category notify { notify_file; };
    category client { client_file; };
    category unmatched { unmatched_file; };
    category queries { queries_file; };
    category network { network_file; };
    category update { update_file; };
    category dispatch { dispatch_file; };
    category dnssec { dnssec_file; };
    category lame-servers { lame-servers_file; };
};

Hope this helps.

Steven Carr
  • 1,096
  • 8
  • 7
  • Thanks for the information. But the issue here is, I have zone files looped within a single folder, for each domain. Say for example.com, I have around 6 sub-zone files using the INCLUDE clause within the master zone file. I would like to know the particular zone file from which the query is extracting the information from. I have added your log clause in my bind. Will check & let you know if it helps. Thanks for your help. – deppfx Aug 25 '12 at 05:26
  • 2
    I doubt that it's actually possible, and standard logging would not give you that level of detail. BIND loads the zone files into memory on startup so the files themselves are meaningless once it's started, it's just one complete zone. Enabling debug mode in BIND might give you additional levels of detail, but it's going to cause a huge amount of logging to be generated which will inturn impact the performance of the DNS server. – Steven Carr Aug 25 '12 at 14:39
  • Why do you think logging everything to separate files is better for debugging? Also beware of useless log messages in most channels when your server is busy. – alexsergeyev Feb 04 '14 at 00:06
  • Detailed information on Bind9 can be found here, explicitly logging as well:http://www.zytrax.com/books/dns/ch7/logging.html You can assign the same category to more than one file and thus have different logging levels on separate files. – eco Sep 16 '15 at 21:02
23

Run command rndc querylog on or add querylog yes; to options{}; section in named.conf to activate that channel.

Also make sure you’re checking correct directory if your bind is chrooted.

Daniel Böhmer
  • 12,527
  • 5
  • 31
  • 45
alexsergeyev
  • 505
  • 2
  • 7
  • I have BIND 9.9.4 on centos7, I try to added the "querylog on;" to the options section, but named not restarted. In journal I had `/etc/named.conf:30: boolean expected near 'on'` – DeamonMV Apr 28 '16 at 09:41
  • I think it might be querylog yes; in config file, I might've mistaken rndc param with config option. – alexsergeyev May 16 '16 at 12:47
  • I found that, while `rndc querylog on` did change the setting reported by `rndc querylog status`, actual logging did not occur until I changed `severity warning` to `severity dynamic` in my *named.conf* file. – CODE-REaD Sep 01 '20 at 15:01