BIND server: how to log queries only for specific DNS record?

Latest response

Situation: decommisioning old DNS records.

There are several DNS records that resolve to the same IP.

 

Is it possible to log queries only for a specific DNS record?

Responses

Hello,

I think bind does not have such filtering available (see below).

logging {
   [ channel channel_name {
     ( file path name
         [ versions ( number | unlimited ) ]
         [ size size_spec ]
       | syslog syslog_facility
       | stderr
       | null );
     [ severity (critical | error | warning | notice |
                 info | debug [ level ] | dynamic ); ]
     [ print-category yes | no; ]
     [ print-severity yes | no; ]
     [ print-time yes | no; ]
   }; ]
   [ category category_name {
     channel_name ; [ channel_name ; ... ]
   }; ]
   ...
};

However, you can achive this by following.

1, You can redirect dns logs to syslog and on syslog you can apply such filtering to log only A records.

2, You can run tcpdump continue to print only A records and redirect output to file (this would be good if you are running this for sort time)

Thanks,

Rupesh Patel

You can filter for inidividual queries but: a) it's not a built-in functionality of BIND (this is a BIND issue, better to look at ISC's support pages than RedHat's), which means you've gotta kludge your way to the functionality; and, b) most of the kludges to achieving this functionality can lead you to filling up your logging partitions VERY quickly (basically, you up the verbosity on BIND's logging and set up a logprocessor to find the desired info).

If this is absolutely a "must have", make sure that you put your BIND logs onto a dedicated logging device so that when it (inevitably fills up), you don't drop your system (e.g., if you have crash-on-full turned on in the audit service configs) and you don't make BIND or other applications choke when their parition fills up.