named log gaps/pause

[Frey, Rick E]

You don’t mention your query rates.   By chance is syslog rate limiting the messages sent by querylog channel?



From: bind-users <bind-users-bounces at lists.isc.org> on behalf of Speagle, Andy via bind-users <bind-users at lists.isc.org>
Hey Folks,

I'm seeing something really strange with 9.16.26 ... we're getting like
10min gaps in the logs sent to syslog... the server seems to work just
fine... it just stops logging for long periods of time. We're using
rsyslog on el8 ...

Our logging looks like this:

logging {
    channel dns_syslog {
        syslog local0;
        severity info;
    };

    category default { dns_syslog; };

    //  Don't log denied queries (after closing recursive resolution).
    //  In spite of the title, the security category is *only*
    //  approval and denial of requests.
    category security { null; };

    //  Don't log format errors from lame servers.
    category lame-servers { null; };

    //  Don't log format errors of other types.
    category resolver { null; };

    //  Log queries of records for which we're authoritative.
    //  They don't seem to be filterable in named so they're being
filtered
    //  in syslog-ng.
    channel querylog {
        syslog local6;
        severity debug 3;
        print-category yes;
        print-time yes;
    };

    category queries { querylog; };
};

This all looks pretty standard... anyone else seen this?

Thanks,

Andy



Sensitivity: Internal
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.isc.org/pipermail/bind-users/attachments/20220311/f7f38c9d/attachment.htm>