We have named_queries enabled, but in addition to writing to /var/log/named/named_querylog as configured, it’s also writing to /var/log/messages constantly, making it about useless for troubleshooting other, minor DNS issues I have that are beyond the scope of this post.
How do I make this stop?
Actually, I made it stop writing temporarily to /var/log/named/named_querylog because I was getting nervous about disk space.
Now if I can just get it to stop flooding /var/log/messages, I’d reenable the desired log.
Here’s from the named.conf:
[INDENT]logging {
channel “simple_log” {
file “/log/bind.log” versions 3 size 5m;
print-time yes;
print-severity yes;
print-category yes;
};
category default{
“simple_log”;
};
channel query_logging {
file “/var/log/named/named_querylog” versions 10 size 500M;
print-time yes; // timestamp log entries
syslog local6; //added by Dave for SEIM test
};
category queries {
query_logging;
};
};[/INDENT]
And this is from the syslog-ng.conf file:(ultimately we want to use an external syslog server but right now it’s down so commented out)
[INDENT]
Filter definitions
filter f_named {facility (local6);};
filter f_messages { not facility(news, mail) and not filter(f_iptables); };
(and some other filters here not relevant to the issue)
Enable this and adopt IP to send log messages to a log server.
#destination logserver { udp(“10.111.3.42” port(514)); };
#log { source(src); destination(logserver); };
Logging for Named
destination dnslog { file("/var/log/named/namedquery.log" owner(root) group(root)); };
#log { source(src) ; filter(f_named); destination(dnslog); };
#SEIM Added as destination for dns logs
destination seim { udp(“10.111.254.9” port(514)); };
log { source(src) ; filter(f_named); destination(seim);
All messages except iptables and the facilities news and mail:
destination messages { file("/var/log/messages"); };
log { source(src); filter(f_messages); destination(messages); };
[/INDENT]
I’m thinking something like this: ?
filter f_messages { not facility(news, mail, local6) and not filter(f_iptables, f_named) ; };
But you made me curious, so I gave it a test run. Here’s the logging part of my test named.conf: