Bind9 Query Log
Prev | Chapter 7. DNS Supported Log Format | Next

## Bind9 Query Log

Bind 9™ logs the same information as Bind 8™ (except whether the request was recursive or not) but in a different format. Bind 9.3 and later versions support a more elaborate log file format, which includes the recursive/non-recursive request indicator again.

### Note

We also support the new date format introduced in Bind9 9.3 which also contains the year (`15-Jul-2002`).

Example 7.3. Sample Bind 9™ Query Log

`print-severity` and `print-category` were set to `yes` to obtain that log. Lire also accepts logs where those are turned off.

    Feb 25 11:09:43.651 queries: info: client 10.0.0.3#1035: \
        query: 3.example.com.nl IN A -
    Feb 25 11:09:48.739 queries: info: client 10.0.0.3#1035: \
        query: 3.example.com.nl IN A -
    Feb 25 12:50:32.476 queries: info: client 10.0.0.3#1035: \
        query: 21.example.com.co.uk IN A -
    Feb 25 12:50:34.110 queries: info: client 10.0.0.3#1035: \
        query: 22.example.com IN A -

### Tip

If you are running a pre-9.3 version of Bind 9™ and you are missing the recursive flag from Bind 8™, it is possible to add back that feature by patching Bind 9™. The following patch by by Wytze van der Raay will add a `+` or `-` after the query type to indicate whether the query was recursive or not. Lire will detect that the log file was made by a patched Bind 9™.

    # patch bin/named/query.c to log recursive/non-recursive query indication
    SRC=bin/named/query.c
    if [ -f ${SRC}.org ]
    then
        echo "Patched ${SRC} already in place"
    else
        echo "Patch ${SRC} for recursive/non-recursive query indication"
        cp -p ${SRC} ${SRC}.org
        patch -p0 ${SRC} <<\!
    --- bin/named/query.c.org       Mon Sep 24 22:57:48 2001
    +++ bin/named/query.c   Tue Sep 25 09:55:21 2001
    @@ -3272,7 +3272,8 @@
            dns_rdatatype_format(rdataset->type, typename, sizeof(typename));

            ns_client_log(client, NS_LOGCATEGORY_QUERIES, NS_LOGMODULE_QUERY,
    -                     level, "query: %s %s %s", namebuf, classname, typename);
    +                     level, "query: %s %s %s%s", namebuf, classname, typename,
    +                     WANTRECURSION(client) ? "+" : "-");
     }

     void
    !
    fi

Prev | Up | Next
Chapter 7. DNS Supported Log Format | Home | Chapter 8. DNS Zone Supported Log Format