DNSTAP doesn't purge old dnstap files
Jesus Cea
jcea at jcea.es
Tue Mar 21 22:38:17 UTC 2023
Hi everybody.
Bind 9.16 here.
I have this configuration for DNSTAP:
"""
dnstap {auth; client; resolver; forwarder;};
dnstap-output file "/var/cache/bind/dnstap.tap" size 100M versions
100 suffix timestamp;
"""
The "dnstap.tap" is correctly moved to "dnstap.tap.TIMESTAMP" a new
"dnstap.tap" file is created when the old one reaches 100MB in size, but
bind is not purging old "dnstap.tap.TIMESTAMP" files when their count
goes over 100. It doesn't delete all files at all.
I configured logging as:
"""
channel dnstaplog {
file "dnstap.log" versions 10 size 5m;
print-time yes;
print-category yes;
severity debug;
print-severity yes;
};
category dnstap { dnstaplog; };
"""
I only see in the logs when a new "dnstap.tap" file is created, but I
don't see anything related to deleting old files, or errors trying to do so:
"""
...
21-Mar-2023 18:44:31.327 dnstap: info: rolling dnstap destination
'/var/cache/bind/dnstap.tap'
21-Mar-2023 18:57:12.937 dnstap: info: rolling dnstap destination
'/var/cache/bind/dnstap.tap'
21-Mar-2023 19:09:23.546 dnstap: info: rolling dnstap destination
'/var/cache/bind/dnstap.tap'
...
"""
Any suggestion?
PS: Previously I was using "increment" instead of timestamped
"dnstap.tap" files and it worked fine (well, reusing/overwriting old
files, not deleting them).
--
Jesús Cea Avión _/_/ _/_/_/ _/_/_/
jcea at jcea.es - https://www.jcea.es/ _/_/ _/_/ _/_/ _/_/ _/_/
Twitter: @jcea _/_/ _/_/ _/_/_/_/_/
jabber / xmpp:jcea at jabber.org _/_/ _/_/ _/_/ _/_/ _/_/
"Things are not so easy" _/_/ _/_/ _/_/ _/_/ _/_/ _/_/
"My name is Dump, Core Dump" _/_/_/ _/_/_/ _/_/ _/_/
"El amor es poner tu felicidad en la felicidad de otro" - Leibniz
More information about the bind-users
mailing list