BIND9_QUERY2DLF.IN(1)   LogReport's Lire Documentation   BIND9_QUERY2DLF.IN(1)


<?><?><?> (NAME)
       bind9_query2dlf - <?><?><?><?><?> <?><?><?><?><?><?><?><?><?>
       <?><?><?><?><?><?> BIND9 <?><?> <?><?><?><?> dlf

<?><?><?><?><?> <?><?><?><?><?> (SYNOPSIS)
       bind9_query2dlf

<?><?><?><?><?><?><?> (DESCRIPTION)
       <?><?><?><?><?> bind9_query2dlf <?><?><?><?><?><?><?><?> <?><?><?>
       <?><?><?><?><?><?> (query log) <?><?><?><?> BIND 9 <?><?> <?><?>
       <?><?><?><?><?> <?><?><?><?><?><?><?><?><?> (stdin) <?><?><?><?><?><?>
       <?><?><?><?><?><?>.

       <?><?><?> <?><?> <?><?><?><?> named.conf <?><?><?>
       <?><?><?><?><?><?><?><?> <?><?><?> <?><?> <?><?><?><?><?>
       <?><?><?><?><?>:

               channel query_logging {
                       file "/var/log/named_querylog"
                       versions 3 size 100M;
                       print-time yes;                 // timestamp log entries
               };

       <?><?><?><?><?><?><?><?> <?><?><?> <?><?><?><?><?><?><?><?>
       <?><?><?><?><?><?><?><?> <?><?><?><?><?><?><?>. <?><?><?><?><?><?>
       <?><?> <?><?><?><?> <?><?><?><?><?> <?><?><?><?><?><?><?><?><?>
       <?><?><?><?> <?><?><?> <?><?> <?><?> <?><?><?> <?><?><?><?><?>
       <?><?><?><?><?> <?><?><?><?>:

                       print-category yes;             // print category name
                       print-severity yes;             // print severity level

       <?><?><?><?><?><?><?> <?><?><?><?><?><?> <?><?><?><?><?><?><?><?>
       <?><?><?><?> BIND <?><?><?><?><?><?><?><?> (<?><?><?><?><?><?> -
       <?><?><?> <<<?><?><?><?>>> <?><?> <?><?><?> <?><?> <?><?><?><?><?><?>)
       <?><?><?> <?><?><?><?><?><?><?><?> <?><?><?><?><?><?><?>.

       <?><?><?><?><?><?> <?><?><?><?><?><?><?> Bind 9.3 <?><?> <?><?>
       <?><?><?><?> <?><?><?><?><?> <?><?><?><?> (15-Jul-2002) <?><?>
       <?><?><?> <?><?><?><?> <?><?><?><?><?> syslog <?><?><?><?><?><?><?>
       <?><?><?><?><?><?><?><?> <?><?><?><?><?><?><?><?>
       <?><?><?><?><?><?><?>.

<?><?><?><?><?> <?><?><?><?><?><?> (LOG EXAMPLES)
       <?><?> <?><?><?><?> <?><?><?><?> <?><?><?><?>
       <?><?><?><?><?><?><?><?><?> print-time<?> print-category <?>
       print-severity:

        Feb 25 11:09:43.651 queries: info: client 10.0.0.3#1035:
         query: 3.example.com.nl IN A
        Feb 25 11:09:48.739 queries: info: client 10.0.0.3#1035:
         query: 3.example.com.nl IN A
        Feb 25 12:50:32.476 queries: info: client 10.0.0.3#1035:
         query: 21.example.com.co.uk IN A
        Feb 25 12:50:34.110 queries: info: client 10.0.0.3#1035:
         query: 22.example.com IN A
        Feb 25 12:50:34.525 lame-servers: info: lame server on
         '22.example.com' (in '23.example.com'?): 10.0.0.4#53
        Feb 25 12:50:34.715 queries: info: client 10.0.0.3#1035:
         query: 24.example.com IN A
        Feb 26 07:30:08.211 queries: info: client 10.0.0.1#1050:
         query: 1.0.0.10.in-addr.arpa IN PTR
        Feb 26 12:26:55.455 queries: info: client 10.0.0.1#1051:
         query: 28.example.com.nl IN MX
        Feb 04 04:02:00.932 general: info: loading configuration
         from '/etc/336.example.com'
        Feb 18 04:02:01.023 security: warning: zone
         '337.example.com.nl' allows updates by IP address, which
         is insecure
        Feb 18 04:02:01.049 config: warning: option 'use-id-pool'
         is obsolete
        Feb 18 04:02:01.049 config: warning: option 'check-names'
         is not implemented
        Feb 18 04:02:01.049 config: warning: option
         'statistics-interval' is not yet implemented
        Feb 18 04:02:01.049 network: info: no IPv6 interfaces found
        Feb 04 16:47:18.289 security: info: client 10.0.0.201#137:
         query denied
        Feb 20 07:26:53.731 general: info: running
        Feb 13 08:01:56.138 general: info: shutting down
        Feb 13 08:01:56.140 network: info: no longer listening on
         10.0.0.3#53
        Feb 14 08:02:13.983 general: info: refresh_callback: zone
         384.example.com/IN: failure for 10.0.0.204#53: timed out

       <?><?><?> <?><?> <?><?><?><?><?> <?><?><?><?> <?><?><?><?><?>
       print-time:

        Aug 27 04:07:13.361 client 127.0.0.1#3123: query: foo.com IN ANY
        Aug 27 04:07:13.438 client 127.0.0.1#3123: query: fu.bar.nl IN AAAA
        Aug 27 04:07:13.443 client 127.0.0.1#3123: query: fu.bar.nl IN A

<?><?><?><?><?><?><?> (EXAMPLES)
       <?><?><?><?> <?><?><?><?><?><?> <?><?> <?><?><?>
       <?><?><?><?><?><?><?><?> <?><?><?><?> bind9:

        $ bind9_query2dlf < dns-query

       <?><?><?><?><?> bind9_query2dlf <?><?><?><?><?><?><?>
       <?><?><?><?><?><?><?><?><?> <?><?><?><?><?><?><?> <?><?><?><?><?><?>
       <?> <?><?><?><?><?> <?><?><?><?> lr_log2report <?><?><?><?><?><?><?><?>
       <?><?><?><?><?><?><?>:

        $ lr_log2report bind9_query < /var/log/dns-query

<?><?><?><?> (NOTES)
       <?><?><?><?><?><?><?><?> BIND 9 <?><?><?> <?><?> 9.3 <?><?><?><?>
       <?><?><?><?><?><?><?><?><?> <?><?> <?><?><?> <?><?><?><?><?><?>
       <?><?><?><?><?><?><?> (recursive) <?><?><?><?> <?><?><?> <?><?>
       <?><?><?><?> <?><?><?><?><?><?><?><?> <?><?><?><?><?> <?><?><?><?> dlf
       <?><?><?><?> (DLF_RESOLVER) <?><?><?><?><?> '-' <?><?><?><?><?>
       <?><?><?>. <?><?> <?><?><?> <?><?><?><?> <?><?> <?><?><?><?><?>
       <?><?><?><?> <?><?><?> <?><?><?><?><?><?><?><?><?> <?><?><?><?> Wytze
       van der Raay:

        # patch bin/named/query.c to log recursive/non-recursive query indication
        SRC=bin/named/query.c
        if [ -f ${SRC}.org ]
        then
                echo "Patched ${SRC} already in place"
        else
                echo "Patch ${SRC} for recursive/non-recursive query indication"
                cp -p ${SRC} ${SRC}.org
                patch -p0 ${SRC} <<\!
        --- bin/named/query.c.org       Mon Sep 24 22:57:48 2001
        +++ bin/named/query.c   Tue Sep 25 09:55:21 2001
        @@ -3272,7 +3272,8 @@
                dns_rdatatype_format(rdataset->type, typename, sizeof(typename));

                ns_client_log(client, NS_LOGCATEGORY_QUERIES, NS_LOGMODULE_QUERY,
        -                     level, "query: %s %s %s", namebuf, classname, typename);
        +                     level, "query: %s %s %s%s", namebuf, classname, typename,
        +                     WANTRECURSION(client) ? "+" : "-");
         }

         void
        !
        fi

       <?><?><?><?> <?><?><?><?> <?><?><?><?><?> <?><?><?><?><?> <?><?><?>
       <?><?><?><?><?> <?><?><?><?><?><?> <?><?>:

        Nov 11 12:06:42.829 queries: info: client 10.0.0.1#3664:
          query: 6.example.com.nl IN A+

       <?><?><?><?><?> '+' <?><?><?><?><?><?><?><?><?><?> <?><?><?><?><?><?>
       <?><?><?><?><?><?><?> (recursive) <?> <?><?><?><?><?> -
       <?><?><?><?><?><?><?><?><?><?> <?><?><?><?><?><?>
       <?><?><?><?><?><?><?><?><?><?> <?><?><?><?> <?><?><?> <?><?><?><?> +
       <?><?> - <?><?><?><?><?><?><?><?><?><?> <?><?><?><?>
       <?><?><?><?><?><?><?><?><?> <?><?><?> <?><?> 9.3 <?><?> bind9
       <?><?><?>. <?><?> <?><?><?><?> Wytze <?><?> <?><?><?><?><?>
       <?><?><?><?> <?><?> <?><?><?><?><?><?> <?><?><?><?> <?><?>
       bind9-workers@isc.org <?><?> <?><?> <?><?><?><?><?>
       <http://www.mail-archive.com/bind9-workers@isc.org/msg00501.html>
       <?><?><?><?><?> <?><?><?> <?><?><?> <?><?><?><?><?><?>
       <?><?><?><?><?><?>.

       <?><?><?> <?><?><?> <?><?><?><?><?><?><?><?> <?><?><?> <?><?><?><?>
       <?><?><?> <?><?><?><?><?><?><?> <?><?><?><?><?><?><?> <?>
       <?><?><?><?><?><?><?><?> <?><?><?><?><?><?><?>.

       <?><?><?><?> BIND 9.3 <?><?> <?><?><?><?><?><?>
       <?><?><?><?><?><?><?><?> <?><?><?><?><?> <?><?> <?><?><?>
       <?><?><?><?><?><?> <?><?><?><?><?><?><?><?> <?><?><?><?><?>
       <?><?><?><?><?><?>. <?><?><?><?><?> <?><?> <?><?><?><?>
       <?><?><?><?><?><?><?> view<?> <?><?><?><?><?><?><?><?><?> (signer) <?>
       EDNS <?><?> <?><?><?> <?><?><?> <?><?><?><?><?><?> <?><?> <?><?><?><?>
       <?><?> <?><?><?> <?><?><?><?> <?><?> <?><?><?><?><?><?><?>
       <?><?><?><?><?><?> <?><?><?><?><?> <?><?><?><?><?><?><?>.

       <?><?> <?><?> <?><?><?><?><?><?> <?><?><?><?><?> <?><?> <?><?><?><?><?>
       <?><?><?><?><?><?><?> <?><?> <?><?><?><?><?> <?><?><?><?><?> Wytze
       <?><?><?><?>:

        This contains the "ISC-compatible" version of  the patch for getting a
        recursive/non-recursive request logged. ISC decided there should be a space
        between the type and the recursion indicator in the logfile, so be it.

       <?><?><?> <?><?><?><?><?><?> BIND 9.2.1 <?><?><?> <?><?> <?><?><?>
       <?><?><?><?><?><?> <?><?> ISC <?><?> <?><?><?><?> 9.3
       <?><?><?><?><?><?><?><?> <?><?><?><?> <?><?><?> <?><?><?><?> <?><?>
       <?><?><?> <?><?><?><?><?><?><?><?> BIND <?><?><?> <?><?><?><?><?>
       <?><?><?><?>:

        --- bin/named/query.c.org       Thu Mar 28 06:10:09 2002
        +++ bin/named/query.c   Wed Jul 17 08:14:41 2002
        @@ -3279,7 +3279,8 @@
                dns_rdatatype_format(rdataset->type, typename, sizeof(typename));

                ns_client_log(client, NS_LOGCATEGORY_QUERIES, NS_LOGMODULE_QUERY,
        -                     level, "query: %s %s %s", namebuf, classname, typename);
        +                     level, "query: %s %s %s %s", namebuf, classname, typename,
        +                     WANTRECURSION(client) ? "+" : "-");
         }

         void

       <?><?><?> <?><?><?><?><?><?><?> <?><?> <?><?> <?><?><?>
       <?><?><?><?><?><?> <?><?><?><?><?><?><?> Wytze <?> ISC <?><?> <?><?>
       <?><?><?><?> <?><?><?> <?> <?><?><?><?><?><?><?><?> <?><?><?><?><?><?>.

<?><?><?><?><?><?><?><?><?> (THANKS)
       <?><?> <?><?><?><?> <?><?> Wytze van der Raay <?><?><?><?>
       <?><?><?><?><?> <?><?> <?><?><?> <?><?><?><?><?><?> BIND 9.

<?><?><?><?><?><?> <?><?><?><?><?><?> (SEE ALSO)
       bind8_query2dlf(1)<?> <?><?><?><?><?><?><?> <?><?><?><?><?><?> bind9
       <?><?> <?><?><?><?><?> <?><?> BIND <?><?><?><?><?> <?><?><?> <?><?><?>
       (<?><?><?><?><?> <?><?> <?><?><?><?><?> <http://isc.org> <?><?>
       <?><?><?><?><?> <?><?><?><?><?> <?><?><?> <?><?><?><?><?><?><?> <?><?>
       <?><?><?><?><?> <http://doc.mdcc.cx/doc/bind/html/logging.html>
       <?><?><?><?><?><?><?><?> <?><?><?><?> <?><?><?><?>).

<?><?><?><?> (VERSION)
       $Id: bind9_query2dlf.in,v 1.7 2006/07/23 13:16:33 vanbaal Exp $

<?><?> <?><?><?> (COPYRIGHT)
       <?><?><?><?><?><?><?><?> (C) 2001 Joost Bekkers <joost@jodocus.org><?>
       <?><?><?><?><?><?><?><?> (C) 2000, 2001, 2002 Stichting LogReport
       Foundation LogReport@LogReport.org

       <?><?><?> <?><?><?><?><?><?> <?><?> <?><?><?><?><?><?><?><?><?>
       <?><?><?><?> <?><?><?><?> <?><?><?> <?><?><?><?><?><?><?><?><?> <?><?>
       <?><?> <?><?><?> <?><?><?><?><?> <<<?><?><?><?><?><?> <?><?><?><?><?>
       <?><?><?><?><?><?> <?><?><?>>> (GNU GPL) <?><?><?><?><?><?><?><?>
       <?><?><?><?> <?><?><?><?><?> <?><?><?><?><?><?><?><?><?><?><?><?>
       <?><?><?><?> (<?><?><?><?> <?> <?><?> <?><?> <?><?><?><?><?><?>
       <?><?><?> <?><?> <?><?><?><?> <?><?><?><?><?><?>)
       <?><?><?><?><?><?><?><?> <?><?><?><?> <?><?> <?><?><?><?><?>
       <?><?><?><?>.

       <?><?><?> <?><?><?><?><?><?> <?><?> <?><?><?> <?><?><?><?>
       <?><?><?><?><?> <?><?><?> <?><?><?> <?><?> <?><?><?><?> <?><?><?><?>
       <?><?><?><?> <?><?><?> <?><?><?><?> <?><?><?><?><?><?>
       <?><?><?><?><?><?> <?><?><?> <?><?><?><?> <?><?><?><?><?> <?><?><?><?>
       <?><?><?><?><?> <?><?><?><?> <?><?> <?><?><?><?><?> <?><?><?><?>
       <?><?><?><?> <?><?> <?><?><?> <?><?><?>. <?><?><?><?>
       <?><?><?><?><?><?> <?><?><?><?><?> <?><?> <?><?><?><?><?><?>
       <?><?><?><?><?> <?><?><?><?><?><?> <?><?><?> <?><?><?><?><?><?>
       <?><?><?><?>.

       <?><?><?> <?><?><?><?> <?><?><?><?><?> <?><?> <?><?><?>
       <?><?><?><?><?><?> <?><?> <?><?><?><?> <?><?> <?><?><?><?><?><?>
       <?><?><?><?><?> <?><?><?><?><?><?> <?><?><?> <?><?> <?><?><?><?><?><?>
       <?><?><?><?> <?><?><?><?><?> (<?><?><?><?> COPYING <?><?>
       <?><?><?><?><?><?>)<?> <?><?> <?><?><?> <?><?><?> <?><?><?><?> <?><?>
       <?><?><?><?><?> <http://www.gnu.org/copyleft/gpl.html>
       <?><?><?><?><?><?> <?><?><?><?><?><?>.

<?><?><?><?><?><?><?> (AUTHOR)
       Joost Bekkers <joost@jodocus.org> <?><?> <?><?><?><?>
       <?><?><?><?><?><?> Edwin Groothuis <?> Joost van Baal<?> <?> <?><?>
       <?><?><?> <?><?><?><?> <?><?><?><?> <?><?><?> LogReport
       <?><?><?><?><?><?><?> <?><?><?><?><?><?>.

Lire 2.1.1                        2025-09-28             BIND9_QUERY2DLF.IN(1)