Home / server / Questions / 250490
Accepted
Daniel C. Sobral
Asked: 2011-03-23 11:28:35 +0800 CST

Can I log specific queries on Bind 9?

  • 772

I'd like to know which hosts make a specific DNS query, and at what times. Is there any way to get logs this specific on Bind 9?

For example, I might want to log all A queries for xyzzy.net.

domain-name-system logging bind

2 Answers

  1. Best Answer

    Put the right sort of channel stanza in your logging{} block in named.conf.

            channel "client" {
            file "/var/log/client_named.log";
            severity info;
            print-time yes;
        };

    would probably do the trick. That should get you this sort of data:

    22-Apr-2011 12:06:53.294 client xxx.xxx.xxx.xxx#56202: view external-in: query: st.in.multi.surbl.org IN A +

    EDIT: Warning - enabling this sort of logging will generate very large log files very quickly, and could easily fill up your disk without having some sort of log rotation/compression, and is probably best suited to a brief data-gathering session, rather than a permanent configuration.

    If that (along with post-processing the resulting log file) is too much, you could do this using a tool like tcpdump.

    tcpdump -i eth0 dst port 53 | egrep 'A' | egrep 'xyyzyy.com'

    or even better, writing a filter to match on only the right bits of the DNS packet that you want to filter on (the A? type in this case)

    Probably easier, though, is to use a tool like dnstop. dnstop webpage will do all the protocol decoding for you, and IIRC you can filter it's output using -n to limit what it captures to a single domain.

    • 2

  2. No, the logging statements do not support filters. You could send Bind logs to syslog and then filter for only the client IP and A record within your syslog rules. That's probably the simplest method.

    • 2