Can I log specific queries on Bind 9?

Question

I'd like to know which hosts make a specific DNS query, and at what times. Is there any way to get logs this specific on Bind 9?

For example, I might want to log all A queries for xyzzy.net.

Answer 1

Put the right sort of channel stanza in your logging{} block in named.conf.

        channel "client" {
            file "/var/log/client_named.log";
            severity info;
            print-time yes;
        };

would probably do the trick. That should get you this sort of data:

22-Apr-2011 12:06:53.294 client xxx.xxx.xxx.xxx#56202: view external-in: query: st.in.multi.surbl.org IN A +

EDIT: Warning - enabling this sort of logging will generate very large log files very quickly, and could easily fill up your disk without having some sort of log rotation/compression, and is probably best suited to a brief data-gathering session, rather than a permanent configuration.

If that (along with post-processing the resulting log file) is too much, you could do this using a tool like tcpdump.

tcpdump -i eth0 dst port 53 | egrep 'A' | egrep 'xyyzyy.com'

or even better, writing a filter to match on only the right bits of the DNS packet that you want to filter on (the A? type in this case)

Probably easier, though, is to use a tool like dnstop. dnstop webpage will do all the protocol decoding for you, and IIRC you can filter it's output using -n to limit what it captures to a single domain.

Answer 2

No, the logging statements do not support filters. You could send Bind logs to syslog and then filter for only the client IP and A record within your syslog rules. That's probably the simplest method.