.\" -*- mode: troff; coding: utf-8 -*-
.\" Automatically generated by Pod::Man v6.0.2 (Pod::Simple 3.45)
.\"
.\" Standard preamble:
.\" ========================================================================
.de Sp \" Vertical space (when we can't use .PP)
.if t .sp .5v
.if n .sp
..
.de Vb \" Begin verbatim text
.ft CW
.nf
.ne \\$1
..
.de Ve \" End verbatim text
.ft R
.fi
..
.\" \*(C` and \*(C' are quotes in nroff, nothing in troff, for use with C<>.
.ie n \{\
.    ds C` ""
.    ds C' ""
'br\}
.el\{\
.    ds C`
.    ds C'
'br\}
.\"
.\" Escape single quotes in literal strings from groff's Unicode transform.
.ie \n(.g .ds Aq \(aq
.el       .ds Aq '
.\"
.\" If the F register is >0, we'll generate index entries on stderr for
.\" titles (.TH), headers (.SH), subsections (.SS), items (.Ip), and index
.\" entries marked with X<> in POD.  Of course, you'll have to process the
.\" output yourself in some meaningful fashion.
.\"
.\" Avoid warning from groff about undefined register 'F'.
.de IX
..
.nr rF 0
.if \n(.g .if rF .nr rF 1
.if (\n(rF:(\n(.g==0)) \{\
.    if \nF \{\
.        de IX
.        tm Index:\\$1\t\\n%\t"\\$2"
..
.        if !\nF==2 \{\
.            nr % 0
.            nr F 2
.        \}
.    \}
.\}
.rr rF
.\"
.\" Required to disable full justification in groff 1.23.0.
.if n .ds AD l
.\" ========================================================================
.\"
.IX Title "BIND8_QUERY2DLF.IN 1"
.TH BIND8_QUERY2DLF.IN 1 2025-09-28 "Lire 2.1.1" "LogReport's Lire Documentation"
.\" For nroff, turn off justification.  Always turn off hyphenation; it makes
.\" way too many mistakes in technical documents.
.if n .ad l
.nh
.SH NAME
bind8_query2dlf \- convert BIND8 querylogs to dlf
.SH SYNOPSIS
.IX Header "SYNOPSIS"
\&\fBbind8_query2dlf\fR
.SH DESCRIPTION
.IX Header "DESCRIPTION"
This script converts each line in a bind8 querylog to a dns dlf record.
.PP
BIND generates these logs when something like
.PP
.Vb 6
\& logging {
\&     channel query_logging {
\&         file "/var/log/named_querylog"
\&         versions 3 size 100M;
\&         print\-time yes;                 // timestamp log entries              
\&      };
\&
\&      category queries {
\&          query_logging;
\&      };
\& };
.Ve
.PP
is in bind\*(Aqs named.conf.  This will save up to three logfiles of maximum 
100 megabytes in the directory /var/log.
.PP
These logfiles look like:
.PP
.Vb 2
\& 10\-Apr\-2000 00:01:20.307 XX /10.2.3.4/1.2.3.in\-addr.arpa/SOA/IN
\& 10\-Apr\-2000 00:01:20.308 XX+/10.4.3.2/host.foo.com/A/IN
.Ve
.SH EXAMPLES
.IX Header "EXAMPLES"
To process a log as produced by bind8:
.PP
.Vb 1
\& $ bind8_query2dlf < dns\-query
.Ve
.PP
bind8_query2dlf will be rarely used on its own, but is more likely
called by lr_log2report:
.PP
.Vb 1
\& $ lr_log2report bind8_query < /var/log/dns\-query
.Ve
.SH "SEE ALSO"
.IX Header "SEE ALSO"
http://www.logreport.org/doc/gen/dns/bind8.php
.PP
\&\fBbind9_query2dlf\fR\|(1)
.SH VERSION
.IX Header "VERSION"
\&\f(CW$Id:\fR bind8_query2dlf.in,v 1.6 2006/07/23 13:16:33 vanbaal Exp $
.SH COPYRIGHT
.IX Header "COPYRIGHT"
Copyright (C) 2000\-2001 Stichting LogReport Foundation LogReport@LogReport.org
.PP
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2 of the License, or
(at your option) any later version.
.PP
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
GNU General Public License for more details.
.PP
You should have received a copy of the GNU General Public License
along with this program (see COPYING); if not, check with
http://www.gnu.org/copyleft/gpl.html.
.SH AUTHOR
.IX Header "AUTHOR"
Edwin Groothuis, now maintained by Joost van Baal