1

I have a challenge where the log files are not recording the resolved IP address in the logged information. How is it possible to enable this? So the url and resolved IP address should be in the logfile. Here is the code:

Configuration:
logging {
    channel query_log {
    file "/var/log/named/query.log";
    severity info;
};
category queries { query_log; };

Current Log file:

04-Nov-2015 08:28:39.261 queries: info: client 192.168.169.122#59319: query: istatic.eshopcomp.com IN A + (10.10.80.50)
04-Nov-2015 08:28:39.269 queries: info: client 192.168.212.136#48872: query: idsync.rlcdn.com IN A + (10.10.80.50)
04-Nov-2015 08:28:39.269 queries: info: client 192.168.19.61#53970: query: 3-courier.sandbox.push.apple.com IN A + (10.10.80.50)
04-Nov-2015 08:28:39.270 queries: info: client 192.168.169.122#59319: query: ajax.googleapis.com IN A + (10.10.80.50) 04-Nov-2015 08:28:39.272 queries: info: client 192.168.251.24#37028: query: um.simpli.fi IN A + (10.10.80.50)
04-Nov-2015 08:28:39.272 queries: info: client 192.168.251.24#37028: query: www.wtp101.com IN A + (10.10.80.50) 04-Nov-2015 08:28:39.273 queries: info: client 192.168.251.24#37028: query: magnetic.t.domdex.com IN A + (10.10.80.50)
04-Nov-2015 08:28:39.273 queries: info: client 172.25.111.175#59612: query: api.smoot.apple.com IN A + (10.10.80.50)
04-Nov-2015 08:28:39.275 queries: info: client 192.168.7.181#45913: query: www.miniclip.com IN A + (10.10.80.50)

Desired Log file:

.... istatic.eshopcomp.com 205.185.208.26 ....
.... idsync.rlcdn.com 54.84.163.33 ....
.... 3-courier.sandbox.push.apple.com 17.172.232.11  ....
.... ajax.googleapis.com 216.58.223.42 ....
.... um.simpli.fi 158.85.41.203 ....
.... www.wtp101.com 52.70.95.71 ....
.... magnetic.t.domdex.com 54.217.251.207 ....
.... api.smoot.apple.com 17.252.91.246 ....
.... www.miniclip.com 54.230.231.23 ....

Assistance will be truly appreciated.

1
  • @kasperd, is there any news over that question? it interesting for me too
    – Gudsaf
    Dec 2, 2020 at 6:51

2 Answers 2

0

If you were actually the authoritative source, the config below should work with:

Configuration: logging { channel query_log { file "/var/log/named/query.log"; severity info; print-time yes; print-severity yes; print-category yes; }; category queries { query_log; };

However, you are not an ISP or a domain service. You are likely not authoritative and you yourself do not manage those records. Unless you manually enter overrides in your bind database, it doesn't look like your local bind wants to get involved with logging someone else's response, if it can.

2
  • 2
    So is there an option to print resolved IP address? The once in the above example do not print the resolved IP address in the DNS server.
    – Hans
    Dec 7, 2015 at 19:37
  • I updated my answer above since I originally made some assumptions that later proved not to be true.
    – Andrew S
    Dec 7, 2015 at 20:23
0

Why don't you parse your logs asynchronously and issue the queries with a script?

If you have a caching DNS server, that would work without much load.

  • Otherwise passivedns may be what you want.

  • Also this might be what you are looking for.

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .