0

I have a DNS Server which runs on a virtual linux box with several IPs. Bind provides some pretty detailed debug logs, however, one piece of information that doesn't seem to be logged is the requested IP address.

For example, if I operated google's DNS servers 8.8.8.8 and 8.8.4.4 on the same box, I would be looking to see if the user requested the DNS record via 8.8.8.8 or 8.8.4.4.

Ideally, I would like not to involve other network traffic monitoring tools, and stick solely with BIND. Another interest of mine is to vary the response based on the requested server ip similar to the view clause in bind, but if the former can be achieved, that seems like it would be much simpler.

Thanks!

Luke Rehmann
  • 103
  • 3

1 Answers1

2

The logging options in Bind 9 are pretty comprehensive, you will need to set up a channel like this: 

channel resolving {
                file "data/named.resolve" versions 10 size 5m;
                severity info;
                print-time yes;
         };

Then a category to force the queries into the channel

 category queries {
                        resolving;
         };

This all goes inside the logging {}; section.

Caveats, if you are logging all queries, you will be spending a lot of time writing those to disk, and they will get big. The options versions 10, size 5m are the way I keep the logs under control, it keeps 10 versions, with the maximum size of 5 MB. I then have a cron job that parses out info before they're deleted by bind.

This is the sort of info I get in that log:

15-Apr-2014 16:15:15.041 client 192.168.xxx.xxx#40978: view That-one : query: XXXXX IN A + (192.168.xxx.xx)

The IP address inside the () is the BIND server IP that responded.

NickW
  • 10,263
  • 1
  • 20
  • 27