0

I have a challenge where the log files are not recording the resolved IP address in the logged information. How is it possible to enable this? So the url and resolved IP address should be in the logfile. Here is the code:

Configuration:
logging {
    channel query_log {
    file "/var/log/named/query.log";
    severity info;
};
category queries { query_log; };

Current Log file:

04-Nov-2015 08:28:39.261 queries: info: client 192.168.169.122#59319: query: istatic.eshopcomp.com IN A + (10.10.80.50)
04-Nov-2015 08:28:39.269 queries: info: client 192.168.212.136#48872: query: idsync.rlcdn.com IN A + (10.10.80.50)
04-Nov-2015 08:28:39.269 queries: info: client 192.168.19.61#53970: query: 3-courier.sandbox.push.apple.com IN A + (10.10.80.50)
04-Nov-2015 08:28:39.270 queries: info: client 192.168.169.122#59319: query: ajax.googleapis.com IN A + (10.10.80.50) 04-Nov-2015 08:28:39.272 queries: info: client 192.168.251.24#37028: query: um.simpli.fi IN A + (10.10.80.50)
04-Nov-2015 08:28:39.272 queries: info: client 192.168.251.24#37028: query: www.wtp101.com IN A + (10.10.80.50) 04-Nov-2015 08:28:39.273 queries: info: client 192.168.251.24#37028: query: magnetic.t.domdex.com IN A + (10.10.80.50)
04-Nov-2015 08:28:39.273 queries: info: client 172.25.111.175#59612: query: api.smoot.apple.com IN A + (10.10.80.50)
04-Nov-2015 08:28:39.275 queries: info: client 192.168.7.181#45913: query: www.miniclip.com IN A + (10.10.80.50)

Desired Log file:

.... istatic.eshopcomp.com 205.185.208.26 ....
.... idsync.rlcdn.com 54.84.163.33 ....
.... 3-courier.sandbox.push.apple.com 17.172.232.11  ....
.... ajax.googleapis.com 216.58.223.42 ....
.... um.simpli.fi 158.85.41.203 ....
.... www.wtp101.com 52.70.95.71 ....
.... magnetic.t.domdex.com 54.217.251.207 ....
.... api.smoot.apple.com 17.252.91.246 ....
.... www.miniclip.com 54.230.231.23 ....

Assistance will be truly appreciated.

0

If you were actually the authoritative source, the config below should work with:

Configuration: logging { channel query_log { file "/var/log/named/query.log"; severity info; print-time yes; print-severity yes; print-category yes; }; category queries { query_log; };

However, you are not an ISP or a domain service. You are likely not authoritative and you yourself do not manage those records. Unless you manually enter overrides in your bind database, it doesn't look like your local bind wants to get involved with logging someone else's response, if it can.

| improve this answer | |
  • 1
    So is there an option to print resolved IP address? The once in the above example do not print the resolved IP address in the DNS server. – Hans Dec 7 '15 at 19:37
  • I updated my answer above since I originally made some assumptions that later proved not to be true. – Andrew S Dec 7 '15 at 20:23
0

Why don't you parse your logs asynchronously and issue the queries with a script?

If you have a caching DNS server, that would work without much load.

  • Otherwise passivedns may be what you want.

  • Also this might be what you are looking for.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.