Querylog on BIND 8

[Kevin Darcy]

Fidel wrote:

>All,
>I am currently running BIND 8 on FreeBSD 4.8 and am trying to retire the
>machine.  I need to find out what clients are querying this machine so I
>can make the appropriate changes when building out the replacement BIND
>box.  I am assuming that querylog is the way to get this information,
>however, it does not appear to be working.  I'm obviously missing something
>somewhere, more than likely in the named.conf file.  Could someone please
>give me an example of the proper syntax for the logging option?  Also, are
>there any additional changes that need to be made to the syslog.conf file. 
>Please enlighten me?
>
(Solaris)

=== named.conf snippet ===

logging {
category queries { default_syslog; };
};

=== end named.conf snippet ===

=== syslog.conf snippet ===

daemon.debug /var/log/daemon.syslog

=== end syslog.conf snippet ==

(You could dial that back a bit if you wish: I think normal queries are 
at the "info" level).

Are you stuck using syslog for this? For various reasons, we're in the 
process of migrating everything over to using BIND's internal logging 
mechanisms instead.

- Kevin