Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I would like to record queries to my DNS from a particular ip. Is this possible?

Right now I have this:

channel query_log {
                file "/var/named/data/queries.log" versions 2 size 1G;
                severity debug 3;
                print-category yes;
                print-severity yes;
                print-time yes;
        };

category queries { query_log;};

As you may imagine, the file "queries.log" grows at an extremely fast rate on our busy network. I just would like to log the queries from a particular ip. Is there a way to do this using any channel option? I thought about creating a separate view (to match the host I want to record) but you can oly have one "logging" option in named.conf (not inside the views) :(

Thanks.

share|improve this question

1 Answer 1

up vote 0 down vote accepted

I do not think there is any way that you can configure bind to do the filtering you want.

I can think of two ways you could achieve the result I believe you want.

Setup bind query logging, keep only 1 versions, and reduce the size of the logs you are keeping.

Leave a command like below running to constantly monitor changes to the query log and store the information you want to save to a separate file.

tail --follow --retry /var/named/data/queries.log \
      | grep 'ip.ad.dd.res' > /var/named/data/queries_ip.ad.dd.res.log

The second method would be to just use tcpdump to capture all incoming requests from that host. You would use a command like this.

tcpdump -n dst port 53 and src host ip.ad.dd.res > /var/log/dns_ip.ad.dd.res.log
share|improve this answer
    
Thanks again Zoredache. The tail idea sounds good and that's what I'm going to do then. I thought about tcpdump but I wanted to see if it was possible using BIND (I like the format of the query log that BIND produces) and thought that maybe there was some switch I was missing but indeed it seems there's no way to perform the filtering natively. Thanks again! –  JFA Nov 6 '09 at 22:08

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.