I have my BIND9 running under a chroot jail, however, I'm having difficulties trying to log all queries.

I have bind under /var/chroot/bind9/ where I created a /var/chroot/bind9/var/log/ directory. I would like to have my query log under the normal /var/log/ directory, so I added the following to my named.conf.local and I did:

# touch /var/log/query.log
# ln -s /var/log/query.log /var/chroot/bind9/var/log/query.log
# chown -R bind:bind /var/chroot/bind9/var/log/

logging {
    channel query.log {
        file "/var/log/query.log";
        severity debug 3;
    category queries { query.log; };

But I keep getting: named[2270]: isc_log_open '/var/log/query.log' failed: invalid file ` Any help is appreciated.


You can't use symlinks in the chroot jail that point outside of the jail - the symlinks get interpreted relative to the new root directory.

So your link:

# ln -s /var/log/query.log /var/chroot/bind9/var/log/query.log

when run chroot('/var/chroot/bind9') ends up pointing back to itself!


make sure /var/chroot/bind9/var/log/ is owned by the user bind is run as.

seems you are on ubuntu.. follow this or disable apparmor


  • @Mike, yeah, actually /var/chroot/bind9/var/log/ is owned by bind:bind as well as /var/chroot/bind9/var/log/query.log – RobertP Jun 11 '11 at 4:31
  • this is ubuntu? – Mike Jun 11 '11 at 4:39
  • @Mike: Debian 6 :) – RobertP Jun 11 '11 at 4:51
  • it is probably the same.. check if apparmor is running – Mike Jun 11 '11 at 13:48
  • @Mike, actually I'm not running apparmor. However, the log for some reason ended up under: /var/chroot/bind9/var/cache/bind/query.log. Thanks! – RobertP Jun 11 '11 at 15:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.