Bind 9™ logs the same information as Bind 8™ (except whether the request was recursive or not) but in a different format. Bind 9.3 and later versions support a more elaborate log file format, which includes the recursive/non-recursive request indicator again.
We also support the new date format introduced in
Bind9
9.3 which also contains
the year (15-Jul-2002
).
Example 7.3. Sample Bind 9™ Query Log
print-severity
and
print-category
were set to
yes
to obtain that log. Lire also
accepts logs where those are turned off.
Feb 25 11:09:43.651 queries: info: client 10.0.0.3#1035: \ query: 3.example.com.nl IN A - Feb 25 11:09:48.739 queries: info: client 10.0.0.3#1035: \ query: 3.example.com.nl IN A - Feb 25 12:50:32.476 queries: info: client 10.0.0.3#1035: \ query: 21.example.com.co.uk IN A - Feb 25 12:50:34.110 queries: info: client 10.0.0.3#1035: \ query: 22.example.com IN A -
If you are running a pre-9.3 version of Bind 9™ and
you are missing the recursive flag from Bind 8™, it is
possible to add back that feature by patching Bind 9™.
The following patch by by Wytze van der Raay will add a
+
or -
after the
query type to indicate whether the query was recursive
or not. Lire will detect that the log file was made by
a patched Bind 9™.
# patch bin/named/query.c to log recursive/non-recursive query indication SRC=bin/named/query.c if [ -f ${SRC}.org ] then echo "Patched ${SRC} already in place" else echo "Patch ${SRC} for recursive/non-recursive query indication" cp -p ${SRC} ${SRC}.org patch -p0 ${SRC} <<\! --- bin/named/query.c.org Mon Sep 24 22:57:48 2001 +++ bin/named/query.c Tue Sep 25 09:55:21 2001 @@ -3272,7 +3272,8 @@ dns_rdatatype_format(rdataset->type, typename, sizeof(typename)); ns_client_log(client, NS_LOGCATEGORY_QUERIES, NS_LOGMODULE_QUERY, - level, "query: %s %s %s", namebuf, classname, typename); + level, "query: %s %s %s%s", namebuf, classname, typename, + WANTRECURSION(client) ? "+" : "-"); } void ! fi