Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have my BIND9 running under a chroot jail, however, I'm having difficulties trying to log all queries.

I have bind under /var/chroot/bind9/ where I created a /var/chroot/bind9/var/log/ directory. I would like to have my query log under the normal /var/log/ directory, so I added the following to my named.conf.local and I did:

# touch /var/log/query.log
# ln -s /var/log/query.log /var/chroot/bind9/var/log/query.log
# chown -R bind:bind /var/chroot/bind9/var/log/

logging {
    channel query.log {
        file "/var/log/query.log";
        severity debug 3;
    };  
    category queries { query.log; };
};

But I keep getting: named[2270]: isc_log_open '/var/log/query.log' failed: invalid file ` Any help is appreciated.

share|improve this question
add comment

2 Answers

You can't use symlinks in the chroot jail that point outside of the jail - the symlinks get interpreted relative to the new root directory.

So your link:

# ln -s /var/log/query.log /var/chroot/bind9/var/log/query.log

when run chroot('/var/chroot/bind9') ends up pointing back to itself!

share|improve this answer
add comment

make sure /var/chroot/bind9/var/log/ is owned by the user bind is run as.

seems you are on ubuntu.. follow this or disable apparmor

https://bugs.launchpad.net/ubuntu/+source/bind9/+bug/236510

share|improve this answer
    
@Mike, yeah, actually /var/chroot/bind9/var/log/ is owned by bind:bind as well as /var/chroot/bind9/var/log/query.log –  RobertP Jun 11 '11 at 4:31
    
this is ubuntu? –  Mike Jun 11 '11 at 4:39
    
@Mike: Debian 6 :) –  RobertP Jun 11 '11 at 4:51
    
it is probably the same.. check if apparmor is running –  Mike Jun 11 '11 at 13:48
    
@Mike, actually I'm not running apparmor. However, the log for some reason ended up under: /var/chroot/bind9/var/cache/bind/query.log. Thanks! –  RobertP Jun 11 '11 at 15:38
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.