發表者討論內容

冷日
(冷日) 發表時間：2013/11/22 6:08

Webmaster

註冊日: 2008/2/19
來自:
發表數: 15771

[轉貼]DNS Bind 設定啟動 log

[Linux] DNS Bind 設定啟動 log

vi /etc/named.conf

	logging {
	        channel default-log {
	                file "/var/log/default-log" versions 10 size 20m;
	                severity info;
	        };

	        channel lamer-log {
	                file "/var/log/lamer-log" versions 3 size 10m;
	                severity info;
                  print-severity yes;
	                print-time yes;
	                print-category yes;
	        };

	        channel query-log {
	                file "/var/log/query-log" versions 10 size 10m;
	                severity info;
	        };

	        channel security-log {
	                file "/var/log/security-log" versions 3 size 1m;
	                severity info;
	                print-severity yes;
	                print-time yes;
	                print-category yes;
	        };

	        category lame-servers { lamer-log; };
	        category security{ security-log;};
	        category queries { query-log;};
	        category default {default-log;};
	};

按照這個設定的話，記錄下來的 log 檔案是會存在 /var/named/chroot/var/log/ 路徑底下。

原文出處： DNS Bind 設定啟動 log ( 程式碼集散地 - 社群文章 )

回覆

冷日
(冷日) 發表時間：2013/11/22 6:10

Webmaster

註冊日: 2008/2/19
來自:
發表數: 15771

[轉貼]DNS BIND logging Clause

DNS BIND logging Clause

This section describes the logging clause which prior to BIND 9 needed to appear first in the named.conf file. This no longer the case and it may appear anywhere convenient. BIND uses syslogd before a valid logging clause is available so named.conf parse errors and other information will appear in /var/log/messages (depending on syslog.conf) prior to, or in the absence of, a valid logging clause. In the case of windows parse errors are written to the Event Log. Only one logging clause can be defined but multiple channels may be defined to stream logs.

logging Clause Syntax

BIND provides comprehensive logging features. Values in bold type below are keywords;


logging {
   [ channel channel_name {
     ( file path name
         [ versions ( number | unlimited ) ]
         [ size size_spec ]
       | syslog syslog_facility
       | stderr
       | null );
     [ severity (critical | error | warning | notice |
                 info | debug [ level ] | dynamic ); ]
     [ print-category yes | no; ]
     [ print-severity yes | no; ]
     [ print-time yes | no; ]
   }; ]
   [ category category_name {
     channel_name ; [ channel_name ; ... ]
   }; ]
   ...
};

The following notes describe the various fields and values:

channel channel_name

BIND will accept multiple channel definitions in a single logging statement. 'channel_name' is normally written as a non-space name e.g. my_channel but can be written as a quoted string e.g. "my channel" is an arbitrary but unique name used to associate the category statement with this channel definition or it may take one of the standard (pre-defined) values below:

"default_syslog"
"default_debug"
"default_stderr"
"null"

file

'path_name' is a quoted string defining the absolute path to the logging file e.g. "/var/log/named/namedlog.log". From the grammar above 'file', 'syslog', 'stderr' and 'null' are mutually exclusive for a 'channel'.

versions

'versions' may take the parameter 'number' or 'unlimited' and defines the number of file versions that should be kept by BIND. Version files are created by BIND by appending .0, .1 etc to the file named defined by the file parameter. Files are 'rolled' (renamed or overwritten) so .0 will always contain the last log information prior to commencing the new log., .1 the next and so on. 'unlimited' currently implies 'versions 99'. Unless a size parameter is used new log versions will only be 'rolled' when BIND is restarted. If no versions statement is defined a single log file of unlimited size is used and on restart new data is appended to the defined file. This can get to be a very big file.

size size_spec

'size' allows you to define a limit to the file size created. A numeric only size_spec value is assumed to be the size in bytes, you may use the short forms k or K, m or M, g or G e.g. 25m = 25000000. size and versions are related in the following way:

If you specify a size value and NO versions parameter when the size limit is reached BIND will stop logging until the file size is reduced to below the threshold defined i.e. by deleting or truncating the file.
If you specify a size AND a versions parameter the log files will be 'rolled' (renamed and overwritten as defined in the versions section above) when the size limit is reached.
If you specify NO size AND a versions parameter the log files will be 'rolled' (renamed and overwritten as defined in the versions section above) only when BIND is restarted.

syslog syslog_facility

'syslog' indicates that this channel will use syslogd logging features (as defined in syslog.conf). The syslog_facility is the facility definition for 'syslog' and may be found in syslog's man pages. From the grammar above 'file', 'syslog', 'stderr' and 'null' are mutually exclusive for a 'channel'.

stderr

'stderr' writes to the current standard out and would typically be only used for debug purposes. From the grammar above 'file', 'syslog', 'stderr' and 'null' are mutually exclusive for a 'channel'.

null

'null' writes to /dev/null - the bit bucket, nowhere. It does not produce a log. From the grammar above 'file', 'syslog', 'stderr' and 'null' are mutually exclusive for a 'channel'.

severity

Controls the logging levels and may take the values defined. Logging will occur for any message equal to or higher than the level specified (=>) lower levels will not be logged. Various debug levels can be defined with 'debug 0' meaning no debugging. The value 'dynamic' means assume the global level defined by either the command line parameter -d or by running rndc trace.

print-time yes | no

Controls whether the date and time are written to the output channel (yes) or not (no). The default is 'no'.

print-severity yes | no

Controls whether the severity level is written to the output channel (yes) or not (no). The default is 'no'.

print-category yes | no

Controls whether the severity level is written to the output channel (yes) or not (no). The default is 'no'.

category category_name

Controls what categories are logged to the various defined or default 'channel_names'. The category_name (a quotes string e.g. "default") may take one of the following values:

client	Processing of client requests.
config	Configuration file parsing and processing.
database	Messages relating to the databases used internally by the name server to store zone and cache data.
default	Logs all values which are not explicitly defined in category statements i.e. if this is the only category defined it will log all categories listed in this table with the exception of queries which are not turned on by default.
delegation-only	Logs queries that have returned NXDOMAIN as the result of a delegation-only zone or a delegation-only statement in a hint or stub zone declaration.
dispatch	Dispatching of incoming packets to the server modules where they are to be processed.
dnssec	DNSSEC and TSIG protocol processing.
general	Anything that is not classified as any other item in this list defaults to this category..
lame-servers	Lame servers. Mis-configuration in the delegation of domains discovered by BIND 9 when trying to authoritative answers. If the volume of these messages is high many users elect to send them to the null channel e.g. category lame-servers {null;}; statement.
network	Logs all network operations.
notify	Logs all NOTIFY operations.
queries	Logs all query transactions. The querylog statement may be used to override this category statement. This entry can generate a substantial volume of data very quickly. This category is not turned on by default and hence the default type above will not log this information.
resolver	Name resolution including recursive lookups performed on behalf of clients by a caching name server.
security	Approval and denial of requests.
unmatched	No matching view clause or unrecognized class value. A one line summary is also logged to the client category. By default this category is sent to the null channel.
update	Logging of all dynamic update (DDNS) transactions.
update-security	Approval and denial of update requests used with DDNS.
xfer-in	Details of zone transfers the server is receiving.
xfer-out	Details of zone transfers the server is sending.

Examples

The first example shows a minimal logging configuration that will work and generate modest log volumes.


logging{
  channel simple_log {
    file "/var/log/named/bind.log" versions 3 size 5m;
    severity warning;
    print-time yes;
    print-severity yes;
    print-category yes;
  };
  category default{
    simple_log;
  };
};

原文出處：DNS BIND logging Clause

回覆

冷日
(冷日) 發表時間：2013/11/22 6:12

Webmaster

註冊日: 2008/2/19
來自:
發表數: 15771

[轉貼]How to enabled named/bind/DNS full logging?

How to enabled named/bind/DNS full logging?

I am trying to find the perfect logging clause in named.conf that would help me enable full-level logs for named service. Can someone give an example here? My current clause is given below, but this generates very minimal logs.

    logging {

        channel querylog{

                    file "/var/log/querylog";
                    severity debug 10;
                    print-category yes;
                    print-time yes;
                    print-severity yes;
                    };

        category queries { querylog;}; };

Run command "rndc querylog on" or add "querylog on;" to named.conf options section to activate that channel.

Also make sure you're checking correct directory if your bind is chrooted.

I usually expand each log out into it's own channel and then to a separate log file, certainly makes things easier when you are trying to debug specific issues. So my logging section looks like the following:

logging {
    channel default_file {
        file "/var/log/named/default.log" versions 3 size 5m;
        severity dynamic;
        print-time yes;
    };
    channel general_file {
        file "/var/log/named/general.log" versions 3 size 5m;
        severity dynamic;
        print-time yes;
    };
    channel database_file {
        file "/var/log/named/database.log" versions 3 size 5m;
        severity dynamic;
        print-time yes;
    };
    channel security_file {
        file "/var/log/named/security.log" versions 3 size 5m;
        severity dynamic;
        print-time yes;
    };
    channel config_file {
        file "/var/log/named/config.log" versions 3 size 5m;
        severity dynamic;
        print-time yes;
    };
    channel resolver_file {
        file "/var/log/named/resolver.log" versions 3 size 5m;
        severity dynamic;
        print-time yes;
    };
    channel xfer-in_file {
        file "/var/log/named/xfer-in.log" versions 3 size 5m;
        severity dynamic;
        print-time yes;
    };
    channel xfer-out_file {
        file "/var/log/named/xfer-out.log" versions 3 size 5m;
        severity dynamic;
        print-time yes;
    };
    channel notify_file {
        file "/var/log/named/notify.log" versions 3 size 5m;
        severity dynamic;
        print-time yes;
    };
    channel client_file {
        file "/var/log/named/client.log" versions 3 size 5m;
        severity dynamic;
        print-time yes;
    };
    channel unmatched_file {
        file "/var/log/named/unmatched.log" versions 3 size 5m;
        severity dynamic;
        print-time yes;
    };
    channel queries_file {
        file "/var/log/named/queries.log" versions 3 size 5m;
        severity dynamic;
        print-time yes;
    };
    channel network_file {
        file "/var/log/named/network.log" versions 3 size 5m;
        severity dynamic;
        print-time yes;
    };
    channel update_file {
        file "/var/log/named/update.log" versions 3 size 5m;
        severity dynamic;
        print-time yes;
    };
    channel dispatch_file {
        file "/var/log/named/dispatch.log" versions 3 size 5m;
        severity dynamic;
        print-time yes;
    };
    channel dnssec_file {
        file "/var/log/named/dnssec.log" versions 3 size 5m;
        severity dynamic;
        print-time yes;
    };
    channel lame-servers_file {
        file "/var/log/named/lame-servers.log" versions 3 size 5m;
        severity dynamic;
        print-time yes;
    };

    category default { default_file; };
    category general { general_file; };
    category database { database_file; };
    category security { security_file; };
    category config { config_file; };
    category resolver { resolver_file; };
    category xfer-in { xfer-in_file; };
    category xfer-out { xfer-out_file; };
    category notify { notify_file; };
    category client { client_file; };
    category unmatched { unmatched_file; };
    category queries { queries_file; };
    category network { network_file; };
    category update { update_file; };
    category dispatch { dispatch_file; };
    category dnssec { dnssec_file; };
    category lame-servers { lame-servers_file; };
};

Hope this helps.

原文出處：How to enabled named/bind/DNS full logging? - Stack Overflow

回覆

冷日
(冷日) 發表時間：2013/11/22 6:17

Webmaster

註冊日: 2008/2/19
來自:
發表數: 15771

[轉貼]BIND - logging file not found

BIND - logging file not found

[Log in to get rid of this advertisement]
I'm setting up BIND following the guidelines in the book Fedora Core 3 Unleashed. There is suggested a logging section in /etc/named.conf. I have the following
Code:

logging {
	channel custom {
		file "/tmp/named.log";
		print-time yes;			#  timestamps
		print-category yes;
	};

	category config 	{ custom; };
	category notify		{ custom; };
	category dnssec		{ custom; };
	category general	{ custom; };
	category security	{ custom; };
	category xfer-out	{ custom; };	# zone transfers
	category lame-servers { custom; };
};

After starting the server, the following is reported:

[root@larsdell ~]# tail /var/log/messages
Apr 29 21:17:53 localhost named[12102]: no longer listening on 129.241.151.90#53
Apr 29 21:17:58 localhost named[12198]: starting BIND 9.2.5 -u named -t /var/named/chroot
Apr 29 21:17:58 localhost named[12198]: using 1 CPU
Apr 29 21:17:58 localhost named[12198]: loading configuration from '/etc/named.conf'
Apr 29 21:17:58 localhost named[12198]: listening on IPv4 interface lo, 127.0.0.1#53
Apr 29 21:17:58 localhost named[12198]: listening on IPv4 interface eth0, 129.241.151.90#53
Apr 29 21:17:58 localhost named[12198]: command channel listening on 127.0.0.1#953
Apr 29 21:17:58 localhost named[12198]: logging channel 'custom' file '/tmp/named.log': file not found
Apr 29 21:17:58 localhost named[12198]: isc_log_open '/tmp/named.log' failed: file not found
Apr 29 21:17:58 localhost named: named startup succeeded

I have created the file as shown:

[root@larsdell ~]# ls -l /tmp/named.log
-rwxr--r-- 1 named named 0 Apr 29 20:28 /tmp/named.log

The status of the service reports 'query logging is OFF'.

Does anyone have a suggestion?

Don't put it in /tmp, put it in /var/log/named, make sure /var/log/named is owned by the process that runs named.

I had the same problem with FC3, here is what I use:

logging {
channel "logfile" {
file "named.log" versions 5 size 5m;
print-time yes;
print-severity yes;
print-category yes;
};
category "default" { "logfile"; };
category "general" { "logfile"; };
category "update" { "logfile"; };
category "queries" { "logfile"; };
};

The log file ends up in /var/named/chroot/var/named due to the chroot.

I still haven't been able to get the dump-file and statistics-file working though.

This is strange. I use a mix of your suggestions in the logging section:

logging {
  channel "logfile" {
    file "/var/log/named/named.log" versions 5 size 5m;
    print-time yes;
    print-severity yes;
    print-category yes;
};
  category "default" { "logfile"; };
  category "general" { "logfile"; };
  category "update" { "logfile"; };
  category "queries" { "logfile"; };
};

As Technoslave suggested, I created a directory like this

[root@larsdell named]# ls -al /var/log/named
total 16
drwxr-xr-x   2 named named 4096 Apr 30 16:46 .

A reboot followed by a 'service named stop' and 'service named start' three minutes later, resulted in the following:

[root@larsdell ~]# tail -n 500 /var/log/messages | grep named
Apr 30 17:19:35 localhost named[3393]: starting BIND 9.2.5 -u named -t /var/named/chroot
Apr 30 17:19:35 localhost named: named startup succeeded
Apr 30 17:22:14 localhost named:  succeeded
Apr 30 17:22:22 localhost named[5137]: starting BIND 9.2.5 -u named -t /var/named/chroot
Apr 30 17:22:22 localhost named[5137]: using 1 CPU
Apr 30 17:22:22 localhost named[5137]: loading configuration from '/etc/named.conf'
Apr 30 17:22:22 localhost named[5137]: listening on IPv4 interface lo, 127.0.0.1#53
Apr 30 17:22:22 localhost named[5137]: listening on IPv4 interface eth0, 129.241.151.90#53
Apr 30 17:22:22 localhost named[5137]: command channel listening on 127.0.0.1#953
Apr 30 17:22:22 localhost named[5137]: logging channel 'logfile' file '/var/log/named/named.log': file
not found
Apr 30 17:22:22 localhost named[5137]: isc_log_open '/var/log/named/named.log' failed: file not found
Apr 30 17:22:22 localhost named: named startup succeeded

[root@larsdell ~]# ls -l /var/log/named/named.log
-rw-r--r--  1 named named 0 Apr 30 17:11 /var/log/named/named.log

1. Can someone explain to me why these two different outcomes appears?

I think I've tried both, but anyway:
2. Should I 'touch', 'chown' and 'chmod' manually to create the file or will named create the file itself if necessary?

3. Just to be sure, the user 'named' is always running the process 'named', no matter which user is logged in?
The service named starts automatically in runlevel 5.

[root@larsdell named]# ps aux | grep named
named    16066  0.0  1.0 37752 2728 ?        Ssl  16:46   0:00 /usr/sbin/named -u named -t /var/named/chroot

try specifying the log file like this:

Code:

 file "named.log" versions 5 size 5m;

the error log is reporting "file not found" because the directory /var/named/chroot/var/log/named/ probably does not exist. Take a look at the chroot command.

[Quote]
Originally posted by Antonius_Block
the error log is reporting "file not found" because the directory /var/named/chroot/var/log/named/ probably does not exist.
[/Quote]
Thanks, no errors during start-up now.

原文出處： BIND - logging file not found

回覆

主題一覽的下方

討論串

前一個主題 | 下一個主題 | 頁首 |

| |

發表新主題

小企鵝開談 : [轉貼]DNS Bind 設定啟動 log

DNS BIND logging Clause

logging Clause Syntax

Examples