BIND log format Splunk regex

I am told from my Splunk experts that the vendor supplied Splunk app for isc-bind matches the BIND 9.8 version used in RHEL6, but not the BIND 9.11 version using in RHEL7. I have a mix now. Does anyone have a REGEX for 9.11, or better yet, a regex that matches both formats? -- Bob Harold __

BIND log question

Hi, I saw what in BIND logs, transfer of 'zone.name/IN' from 106.185.xx.xx#53: Transfer completed: 0 messages, 1 records, 0 bytes, 0.367 secs (0 bytes/sec) what does it mean: 0 messages, 1 records? what's the 1 records? Thanks. ___ Please visit htt

Re: Can bind log the IP of clients requesting lookups to a domain?

On Friday 05 February 2010 19:16:12 Keith Christian wrote: > In other words, I'd like to know the IP of clients trying to resolve > app01.foocompany.net (for example.) I tried once to do this but couldn't find a any way to do it natively with Bind. It seems that, once you turn on query logging,

Re: Can bind log the IP of clients requesting lookups to a domain?

On 2/5/2010 3:16 PM, Keith Christian wrote: > Version - bind 9.5.1 on CentOS 5.x. Is there a way to log either the > IP of clients requesting lookups of a particular domain? > > In other words, I'd like to know the IP of clients trying to resolve > app01.foocompany.net (for example.) > > There i

Can bind log the IP of clients requesting lookups to a domain?

Version - bind 9.5.1 on CentOS 5.x. Is there a way to log either the IP of clients requesting lookups of a particular domain? In other words, I'd like to know the IP of clients trying to resolve app01.foocompany.net (for example.) There is probably a logging option but I'm not sure what it might

BIND Log

Hi All, I'm using BIND 9.3.3rc2, I got the log below. again and again Feb 5 14:24:27 ns01 named[7791]: lame server resolving 'researchcap.com' (in 'researchcap.com'?): 209.115.142.1#53 Feb 5 14:24:27 ns01 named[7791]: lame server resolving 'conztract.com' (in 'conztract.com'?): 67.212.177.42#53