0

I would like to find a way to log requests to a DNS server, for website statistics. It would be great if the server uses MySQL as backend server, too.

I guess this is possible, given the number of managed DNS services who have a per-request price. But I can't find any.

Does anyone have an idea, or should I modify an existing DNS server myself ?

Thanks.

Pierre

2
  • I'm not sure I understand. You want to log the DNS lookups for your web site?
    – joeqwerty
    Oct 19 '10 at 19:49
  • Give us a clue, what DNS server are you using? Oct 19 '10 at 23:37
2

One way would be turning the BIND logging:

logging{
  channel simple_log {
    file "/var/log/bind.log" versions 3 size 5m;
    severity warning;
    print-time yes;
    print-severity yes;
    print-category yes;
  };
  category default{
    simple_log;
  };
};

Or if you have rndc configure you can use:

rndc querylog
1
  • That is assuming you are using BIND as your dns server.
    – Prix
    Oct 19 '10 at 19:56
1

H Pierre,

You mentioned MySQL so I am assuming Linux and Bind.

should be something like this inside the named.conf

logging{
  channel queries_log{
    file "/var/log/named/dns.log" versions 5 size 500m;
    print-time yes;
  };
  category queries{
    queries_log;
  };
};
2
  • Assumption is the mother of all stuff-ups. MySQL will run on Windows and Mac just as readily and BIND is not the only DNS server used on Linux, or any other OS. Your assumptions MIGHT be correct but that doesn't justify them. Oct 19 '10 at 23:40
  • John, of course you're right but you sound a little pedantic. If the asker doesn't feel the need to specify, then these assumptions are all we can work with. Feel free to provide another answer, for other software. Jun 23 '11 at 21:15
1

The answers already given here show how to get your queries in a flat text file. You asked about using MySQL as a backend and this is definitely possible.

After configuring BIND for query logging per the examples given, you can send those messages to a syslog server (either local to the BIND server or on another host.

Walking you through that would be beyond the scope of this site, though. Something like this tutorial would be a good place to start, though:

Set up rsyslog to store syslog messages in MySQL

1

Using the name server itself (for instance BIND in Prix's response) loads seriously the software (which now has to format every request and to do an I/O) and depends on the software you use.

I suggest instead to capture the paquets (either on the machine itself or on another machine, with Ethernet port mirroring) and then to use a statistics program. For the capture, use tcpdump or tshark or pcapdump (one thing I like about pcapdump is that it does sampling). The Mother of DNS statistics program is DSC.

If you like RDBMS, DNSmezzo puts the result of the capture in a PostgreSQL database where you can study at will with SQL requests.

0

Just as an aside, even though some managed dns providers charge by the query, it is sometimes a guesstimate derived from sampling because it takes some serious processing to do exact counts when many domains are involved.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.