> On 20 Oct 2020, at 17:28, Rick Dicaire <kri...@gmail.com> wrote: > > On Tue, Oct 20, 2020 at 10:17 AM <senthan.sivasunda...@szkb.ch> wrote: > Dear BIND-Users, > > Does someone has an idea, which log I have to activate. > > > Do you have querylog enabled?
Querylog is not enough. It will tell you which clients are sending which queries, but not which queries go to the Server Of Interest. It won’t log the queries the recursive server sends itself. That’s a good use case for dnstap. As a sort of desperate measure you can capture packets sent to the suspicious IP addresses (no need to put the interface in promisc mode) and check which queries were sent to them. Borja. _______________________________________________ Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list ISC funds the development of this software with paid support subscriptions. Contact us at https://www.isc.org/contact/ for more information. bind-users mailing list bind-users@lists.isc.org https://lists.isc.org/mailman/listinfo/bind-users
