.\" -*- mode: troff; coding: utf-8 -*-
.\" Automatically generated by Pod::Man v6.0.2 (Pod::Simple 3.45)
.\"
.\" Standard preamble:
.\" ========================================================================
.de Sp \" Vertical space (when we can't use .PP)
.if t .sp .5v
.if n .sp
..
.de Vb \" Begin verbatim text
.ft CW
.nf
.ne \\$1
..
.de Ve \" End verbatim text
.ft R
.fi
..
.\" \*(C` and \*(C' are quotes in nroff, nothing in troff, for use with C<>.
.ie n \{\
.    ds C` ""
.    ds C' ""
'br\}
.el\{\
.    ds C`
.    ds C'
'br\}
.\"
.\" Escape single quotes in literal strings from groff's Unicode transform.
.ie \n(.g .ds Aq \(aq
.el       .ds Aq '
.\"
.\" If the F register is >0, we'll generate index entries on stderr for
.\" titles (.TH), headers (.SH), subsections (.SS), items (.Ip), and index
.\" entries marked with X<> in POD.  Of course, you'll have to process the
.\" output yourself in some meaningful fashion.
.\"
.\" Avoid warning from groff about undefined register 'F'.
.de IX
..
.nr rF 0
.if \n(.g .if rF .nr rF 1
.if (\n(rF:(\n(.g==0)) \{\
.    if \nF \{\
.        de IX
.        tm Index:\\$1\t\\n%\t"\\$2"
..
.        if !\nF==2 \{\
.            nr % 0
.            nr F 2
.        \}
.    \}
.\}
.rr rF
.\"
.\" Required to disable full justification in groff 1.23.0.
.if n .ds AD l
.\" ========================================================================
.\"
.IX Title "BIND9_QUERY2DLF.IN 1"
.TH BIND9_QUERY2DLF.IN 1 2025-09-28 "Lire 2.1.1" "LogReport's Lire Documentation"
.\" For nroff, turn off justification.  Always turn off hyphenation; it makes
.\" way too many mistakes in technical documents.
.if n .ad l
.nh
.SH NAME
bind9_query2dlf \- convert BIND9 querylogs to dlf
.SH SYNOPSIS
.IX Header "SYNOPSIS"
\&\fBbind9_query2dlf\fR
.SH DESCRIPTION
.IX Header "DESCRIPTION"
bind9_query2dlf expects BIND 9 query log files on stdin.
.PP
If you have a
.PP
.Vb 5
\&        channel query_logging {
\&                file "/var/log/named_querylog"
\&                versions 3 size 100M;
\&                print\-time yes;                 // timestamp log entries
\&        };
.Ve
.PP
in your named.conf, the produced logfiles are supported.  Optionally, you
could add
.PP
.Vb 2
\&                print\-category yes;             // print category name
\&                print\-severity yes;             // print severity level
.Ve
.PP
to this channel.  Query logs as produced by a patched BIND (see NOTES below)
are supported too.
.PP
We also support Bind 9.3 log file which uses a new date format
(15\-Jul\-2002) instead of the old\-syslog one.
.SH EXAMPLE
.IX Header "EXAMPLE"
With print\-time, print\-category and print\-severity set:
.PP
.Vb 10
\& Feb 25 11:09:43.651 queries: info: client 10.0.0.3#1035:
\&  query: 3.example.com.nl IN A
\& Feb 25 11:09:48.739 queries: info: client 10.0.0.3#1035:
\&  query: 3.example.com.nl IN A
\& Feb 25 12:50:32.476 queries: info: client 10.0.0.3#1035:
\&  query: 21.example.com.co.uk IN A
\& Feb 25 12:50:34.110 queries: info: client 10.0.0.3#1035:
\&  query: 22.example.com IN A
\& Feb 25 12:50:34.525 lame\-servers: info: lame server on
\&  \*(Aq22.example.com\*(Aq (in \*(Aq23.example.com\*(Aq?): 10.0.0.4#53
\& Feb 25 12:50:34.715 queries: info: client 10.0.0.3#1035:
\&  query: 24.example.com IN A
\& Feb 26 07:30:08.211 queries: info: client 10.0.0.1#1050:
\&  query: 1.0.0.10.in\-addr.arpa IN PTR
\& Feb 26 12:26:55.455 queries: info: client 10.0.0.1#1051:
\&  query: 28.example.com.nl IN MX
\& Feb 04 04:02:00.932 general: info: loading configuration
\&  from \*(Aq/etc/336.example.com\*(Aq
\& Feb 18 04:02:01.023 security: warning: zone
\&  \*(Aq337.example.com.nl\*(Aq allows updates by IP address, which
\&  is insecure
\& Feb 18 04:02:01.049 config: warning: option \*(Aquse\-id\-pool\*(Aq
\&  is obsolete
\& Feb 18 04:02:01.049 config: warning: option \*(Aqcheck\-names\*(Aq
\&  is not implemented
\& Feb 18 04:02:01.049 config: warning: option
\&  \*(Aqstatistics\-interval\*(Aq is not yet implemented
\& Feb 18 04:02:01.049 network: info: no IPv6 interfaces found
\& Feb 04 16:47:18.289 security: info: client 10.0.0.201#137:
\&  query denied
\& Feb 20 07:26:53.731 general: info: running
\& Feb 13 08:01:56.138 general: info: shutting down
\& Feb 13 08:01:56.140 network: info: no longer listening on
\&  10.0.0.3#53
\& Feb 14 08:02:13.983 general: info: refresh_callback: zone
\&  384.example.com/IN: failure for 10.0.0.204#53: timed out
.Ve
.PP
With only print\-time set:
.PP
.Vb 3
\& Aug 27 04:07:13.361 client 127.0.0.1#3123: query: foo.com IN ANY
\& Aug 27 04:07:13.438 client 127.0.0.1#3123: query: fu.bar.nl IN AAAA
\& Aug 27 04:07:13.443 client 127.0.0.1#3123: query: fu.bar.nl IN A
.Ve
.SH EXAMPLES
.IX Header "EXAMPLES"
To process a log as produced by bind9:
.PP
.Vb 1
\& $ bind9_query2dlf < dns\-query
.Ve
.PP
bind9_query2dlf will be rarely used on its own, but is more likely
called by lr_log2report:
.PP
.Vb 1
\& $ lr_log2report bind9_query < /var/log/dns\-query
.Ve
.SH NOTES
.IX Header "NOTES"
Bind9 versions before 9.3 did not log wether the query was recursive,
therefore the last dlf field (DLF_RESOLVER) is a \*(Aq\-\*(Aq.  However,
applying this patch by Wytze van der Raay:
.PP
.Vb 10
\& # patch bin/named/query.c to log recursive/non\-recursive query indication
\& SRC=bin/named/query.c
\& if [ \-f ${SRC}.org ]
\& then
\&         echo "Patched ${SRC} already in place"
\& else
\&         echo "Patch ${SRC} for recursive/non\-recursive query indication"
\&         cp \-p ${SRC} ${SRC}.org
\&         patch \-p0 ${SRC} <<\e!
\& \-\-\- bin/named/query.c.org       Mon Sep 24 22:57:48 2001
\& +++ bin/named/query.c   Tue Sep 25 09:55:21 2001
\& @@ \-3272,7 +3272,8 @@
\&         dns_rdatatype_format(rdataset\->type, typename, sizeof(typename));
\&
\&         ns_client_log(client, NS_LOGCATEGORY_QUERIES, NS_LOGMODULE_QUERY,
\& \-                     level, "query: %s %s %s", namebuf, classname, typename);
\& +                     level, "query: %s %s %s%s", namebuf, classname, typename,
\& +                     WANTRECURSION(client) ? "+" : "\-");
\&  }
\&
\&  void
\& !
\& fi
.Ve
.PP
will yield loglines like
.PP
.Vb 2
\& Nov 11 12:06:42.829 queries: info: client 10.0.0.1#3664:
\&   query: 6.example.com.nl IN A+
.Ve
.PP
A \*(Aq+\*(Aq indicates a recursive query, \- indicates a non\-recursive query,
the lack of + or \- indicates a non\-patched pre\-9.3 bind9.  See Wytze\*(Aqs message
of Fri, 28 Dec 2001 16:56:30 +0100 on bind9\-workers@isc.org , archived
at http://www.mail\-archive.com/bind9\-workers@isc.org/msg00501.html .
.PP
This type of logfiles is recognised by the script.
.PP
BIND 9.3 or later does offer full support for this logging feature.
In addition, it logs view, signer and EDNS information, all of which
will be ignored by this version of the script.
.PP
In a private discussion on Thu, 18 Jul 2002 07:55:22 +0200, Wytze wrote:
.PP
.Vb 3
\& This contains the "ISC\-compatible" version of  the patch for getting a
\& recursive/non\-recursive request logged. ISC decided there should be a space
\& between the type and the recursion indicator in the logfile, so be it.
.Ve
.PP
If you want to have your BIND 9.2.1 to log in the ISC\-compatible 9.3 style,
apply this patch to your BIND sources:
.PP
.Vb 4
\& \-\-\- bin/named/query.c.org       Thu Mar 28 06:10:09 2002
\& +++ bin/named/query.c   Wed Jul 17 08:14:41 2002
\& @@ \-3279,7 +3279,8 @@
\&         dns_rdatatype_format(rdataset\->type, typename, sizeof(typename));
\&
\&         ns_client_log(client, NS_LOGCATEGORY_QUERIES, NS_LOGMODULE_QUERY,
\& \-                     level, "query: %s %s %s", namebuf, classname, typename);
\& +                     level, "query: %s %s %s %s", namebuf, classname, typename,
\& +                     WANTRECURSION(client) ? "+" : "\-");
\&  }
\&
\&  void
.Ve
.PP
\&.  This script understands both Wytze\-style and ISC\-style recursiveness
indication.
.SH THANKS
.IX Header "THANKS"
Wytze van der Raay, for supplying the BIND 9 query log patch.
.SH "SEE ALSO"
.IX Header "SEE ALSO"
\&\fBbind8_query2dlf\fR\|(1), The bind9 online documentation, as distributed with BIND
(but unfortunately not online at http://isc.org/ , you might like
http://doc.mdcc.cx/doc/bind/html/logging.html though)
.SH VERSION
.IX Header "VERSION"
\&\f(CW$Id:\fR bind9_query2dlf.in,v 1.7 2006/07/23 13:16:33 vanbaal Exp $
.SH COPYRIGHT
.IX Header "COPYRIGHT"
Copyright (C) 2001 Joost Bekkers <joost@jodocus.org>,
Copyright (C) 2000, 2001, 2002 Stichting LogReport Foundation LogReport@LogReport.org
.PP
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2 of the License, or
(at your option) any later version.
.PP
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
GNU General Public License for more details.
.PP
You should have received a copy of the GNU General Public License
along with this program (see COPYING); if not, check with
http://www.gnu.org/copyleft/gpl.html.
.SH AUTHOR
.IX Header "AUTHOR"
Joost Bekkers <joost@jodocus.org>, based on Edwin Groothuis and Joost
van Baal\*(Aqs work, now maintained by the LogReport team.