Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I would like to record queries to my DNS from a particular ip. Is this possible?

Right now I have this:

channel query_log {
                file "/var/named/data/queries.log" versions 2 size 1G;
                severity debug 3;
                print-category yes;
                print-severity yes;
                print-time yes;

category queries { query_log;};

As you may imagine, the file "queries.log" grows at an extremely fast rate on our busy network. I just would like to log the queries from a particular ip. Is there a way to do this using any channel option? I thought about creating a separate view (to match the host I want to record) but you can oly have one "logging" option in named.conf (not inside the views) :(


share|improve this question
up vote 0 down vote accepted

I do not think there is any way that you can configure bind to do the filtering you want.

I can think of two ways you could achieve the result I believe you want.

Setup bind query logging, keep only 1 versions, and reduce the size of the logs you are keeping.

Leave a command like below running to constantly monitor changes to the query log and store the information you want to save to a separate file.

tail --follow --retry /var/named/data/queries.log \
      | grep '' > /var/named/data/

The second method would be to just use tcpdump to capture all incoming requests from that host. You would use a command like this.

tcpdump -n dst port 53 and src host > /var/log/
share|improve this answer
Thanks again Zoredache. The tail idea sounds good and that's what I'm going to do then. I thought about tcpdump but I wanted to see if it was possible using BIND (I like the format of the query log that BIND produces) and thought that maybe there was some switch I was missing but indeed it seems there's no way to perform the filtering natively. Thanks again! – JFA Nov 6 '09 at 22:08

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.