0

I have a proxy set up that is taking UDP traffic to load balance internal DNS. It is routing the traffic properly to my backend DNS servers, but I cannot seem to get the log formatting to work correctly.

The error I'm receiving is:

nginx[32103]: nginx: [emerg] unknown log format "dns" in /etc/nginx/nginx.conf:23

I have the log format in the http block, and define it in the stream-->server block. I tried to set the log_format within the stream-->server block, but none of the variables would work.

    user www-data;
    worker_processes auto;
    pid /run/nginx.pid;
    include /etc/nginx/modules-enabled/*.conf;
    
    events {
            worker_connections 768;
            # multi_accept on;
    }
    stream {
    
      upstream dns_servers {
        least_conn;
        server 192.168.3.222:53 fail_timeout=10s;
        server 192.168.70.80:53 fail_timeout=10s;
        server 192.168.70.81:53 fail_timeout=10s;
      }
      server { 
        listen 53 udp;
        proxy_pass dns_servers;
        proxy_responses 1;
        proxy_timeout 1s;
        access_log /var/log/nginx/access.log dns;
    
      }
    }
    
    http {
    
            sendfile on;
            tcp_nopush on;
            tcp_nodelay on;
            keepalive_timeout 65;
            types_hash_max_size 2048;
    
            include /etc/nginx/mime.types;
            default_type application/octet-stream;
    
            ssl_protocols TLSv1 TLSv1.1 TLSv1.2; # Dropping SSLv3, ref: POODLE
            ssl_prefer_server_ciphers on; 
    
            log_format dns '[$time_local] | $remote_addr | $remote_user | $server_name $host to: $upstream_addr | '
                               '"$request" | $status | upstream_response_time $upstream_response_time msec '
                               '$msec | request_time $request_time';
    
            access_log /var/log/nginx/access.log dns;
            error_log /var/log/nginx/error.log;
}

I tried to place log_format in the stream block, but I start getting unknown <variable name> variable.

user www-data;
worker_processes auto;
pid /run/nginx.pid;
include /etc/nginx/modules-enabled/*.conf;

events {
        worker_connections 768;
        # multi_accept on;
}
stream {
 log_format dns '[$time_local] | $remote_addr | $remote_user | $server_name $host to: $upstream_addr | '
                           '"$request" | $status | upstream_response_time $upstream_response_time msec '
                           '$msec | request_time $request_time';

  upstream dns_servers {
    least_conn;
    server 192.168.3.222:53 fail_timeout=10s;
    server 192.168.70.80:53 fail_timeout=10s;
    server 192.168.70.81:53 fail_timeout=10s;
  }
  server { 
    listen 53 udp;
    proxy_pass dns_servers;
    proxy_responses 1;
    proxy_timeout 1s;
    access_log /var/log/nginx/access.log dns;

  }
}

This will not be a web server at all. It will only serve as a proxy for DNS traffic. How do I properly get the logging to function correctly? This is a default nginx.conf file except for the stream block.

0

A log_format for use by stream servers must be declared in the stream block, rather than the http block. These directives are independent of each other. See the documentation for the stream log_format.

4
  • That is in my answer. Thanks. – IRGeekSauce Nov 11 '20 at 21:48
  • @IRGeekSauce I thought it needed to be emphasized that there are two different log_format directives, as this confuses lots of people. – Michael Hampton Nov 11 '20 at 21:52
  • I read that in a hurry. My bad. Great point! Thank you! – IRGeekSauce Nov 11 '20 at 23:35
  • I'm going to go ahead and accept your answer, since you provided the documentation showing how they were independent. – IRGeekSauce Nov 11 '20 at 23:36
0

I figured it out. I found the correct variables, and placed everything in my stream block according to this tutorial.

This is my new stream block:

stream {

    log_format dns '$remote_addr - - [$time_local] $protocol $status $bytes_sent $bytes_received $session_time "$upstream_addr"';

    access_log /var/log/nginx/access.log dns;
    error_log /var/log/nginx/error.log;
  
  upstream dns_servers {
    least_conn;
    server 192.168.3.222:53 fail_timeout=10s;
    server 192.168.70.80:53 fail_timeout=10s;
    server 192.168.70.81:53 fail_timeout=10s;
  }
  server { 
    listen 53 udp;
    proxy_pass dns_servers;
    proxy_responses 1;
    proxy_timeout 1s;
  }
}

And you can see that it is indeed logging:

192.168.2.47 - - [11/Nov/2020:15:29:34 +0000] UDP 200 97 33 0.018 "192.168.3.222:53"
192.168.2.47 - - [11/Nov/2020:15:29:34 +0000] UDP 200 53 37 0.031 "192.168.70.80:53"
192.168.2.47 - - [11/Nov/2020:15:29:34 +0000] UDP 200 142 42 0.046 "192.168.3.222:53"
192.168.2.47 - - [11/Nov/2020:15:29:34 +0000] UDP 200 62 46 0.030 "192.168.70.80:53"
192.168.2.47 - - [11/Nov/2020:15:29:34 +0000] UDP 200 142 38 0.039 "192.168.70.81:53"

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.