On Fri, 30 Jan 2009, Robert Coward wrote:
Sorry, I should have been a been a bit more specific. In reference to the O
Reilly book:
O' Reilly DNS and Bind by Paul Albitz & Cricket Liu (4th Edition)
pg. 163 - 173 (specifically pg. 164, paragraph 4) and
pg. 405 - 421 (info about using the debug options)
The web sites I looked at were:
http://www.bind9.net/manuals
and
http://www.zytrax.com/books/dns
So reading your response the current version of Bind (9.6 I think) does not
have the ability to log the responses.
O Reilly DNS and Bind Paul Albitz & Cricket Liu
Using 9.6.0-P1, I enabled the querylogs option like this:
channel querylogs {
file "/var/log/dnsqueries" size 20m;
severity info;
print-category yes;
print-severity yes;
print-time yes;
};
category queries {querylogs; };
and it generated a quite large log file so I wrote a rather inefficient
bash script to distill it down to more readable format and end up with
this little query report:
Total A NS MX TXT PTR SOA SPF
External 740 310 1 353 2 0 73 0
Internal 33504 23758 1545 1222 5533 1445 0 0
Totals 34244 24068 1546 1575 5535 1445 73 0
Other packets: (if any not detailed)
01-Feb-2009 13:34:27.796 queries: info: client64.246.42.203#40986: view
external: query: maplepark.com IN IXFR -
02-Feb-2009 11:32:54.799 queries: info: client 192.168.102.95#53722: view
internal: query: _ldap._tcp.dc._msdcs.maplepark.com IN SRV +
DDos ( . IN NS) attacks follow: (if any)
(Note: I don't get any of these anymore as I have them dropped at the
firewall. They amount to about 1000 per day, and demanded some sort of
attention to make my logs readable.)
The script via cron runs daily mailing the output and it serves my
purposes for a very small office network.
--
David Forrest
St. Louis, Missouri
_______________________________________________
bind-users mailing list
bind-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users
