Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'd like to know which hosts make a specific DNS query, and at what times. Is there any way to get logs this specific on Bind 9?

For example, I might want to log all A queries for xyzzy.net.

share|improve this question

2 Answers 2

up vote 1 down vote accepted

Put the right sort of channel stanza in your logging{} block in named.conf.

        channel "client" {
            file "/var/log/client_named.log";
            severity info;
            print-time yes;
        };

would probably do the trick. That should get you this sort of data:

22-Apr-2011 12:06:53.294 client xxx.xxx.xxx.xxx#56202: view external-in: query: st.in.multi.surbl.org IN A +

EDIT: Warning - enabling this sort of logging will generate very large log files very quickly, and could easily fill up your disk without having some sort of log rotation/compression, and is probably best suited to a brief data-gathering session, rather than a permanent configuration.

If that (along with post-processing the resulting log file) is too much, you could do this using a tool like tcpdump.

tcpdump -i eth0 dst port 53 | egrep 'A' | egrep 'xyyzyy.com'

or even better, writing a filter to match on only the right bits of the DNS packet that you want to filter on (the A? type in this case)

Probably easier, though, is to use a tool like dnstop. dnstop webpage will do all the protocol decoding for you, and IIRC you can filter it's output using -n to limit what it captures to a single domain.

share|improve this answer
    
I don't see how that helps. I'll edit my question to make it clearer. –  Daniel C. Sobral Mar 22 '11 at 20:05
    
Ahh, I see what you're trying to do. The answer is, I believe, no, but you can get there with post-processing the logs that you get from my original response. Like "cat logfile | egrep xyzzy.net | awk '{print $8" "$10"} | egrep 'A'" –  malcolmpdx Mar 22 '11 at 20:24
    
I don't want to generate that much log. –  Daniel C. Sobral Mar 22 '11 at 20:33
    
That certainly is an issue. You could also do this inline, as it were, without generating any logs. I'll edit the original answer to talk about that. –  malcolmpdx Mar 22 '11 at 20:38
2  
I would be very careful to set up logging like this without any syslog shuffling the logfiles. DNS requests fill up log files blazingly fast. –  pauska Mar 22 '11 at 22:00

No, the logging statements do not support filters. You could send Bind logs to syslog and then filter for only the client IP and A record within your syslog rules. That's probably the simplest method.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.