Bind 9™ logs the same information as Bind 8™ (except whether the request was recursive or not) but in a different format.
We also support the new date format introduced in Bind9 9.3 which also contains the year (15-Jul-2002).
Example 7.3. Sample Bind 9™ Query Log
print-severity and print-category were set to yes to obtain that log. Lire also accepts logs where those are turned off.
Feb 25 11:09:43.651 queries: info: client 10.0.0.3#1035: \ query: 3.example.com.nl IN A Feb 25 11:09:48.739 queries: info: client 10.0.0.3#1035: \ query: 3.example.com.nl IN A Feb 25 12:50:32.476 queries: info: client 10.0.0.3#1035: \ query: 21.example.com.co.uk IN A Feb 25 12:50:34.110 queries: info: client 10.0.0.3#1035: \ query: 22.example.com IN A
If you miss the recursive flag from Bind 8™, it is possible to add back that feature by patching Bind 9™. The following patch by by Wytze van der Raay will add a + or - after the query type to indicate whether the query was recursive or not. Lire will detect that the log file was made by a patched Bind 9™.
# patch bin/named/query.c to log recursive/non-recursive query indication SRC=bin/named/query.c if [ -f ${SRC}.org ] then echo "Patched ${SRC} already in place" else echo "Patch ${SRC} for recursive/non-recursive query indication" cp -p ${SRC} ${SRC}.org patch -p0 ${SRC} <<\! --- bin/named/query.c.org Mon Sep 24 22:57:48 2001 +++ bin/named/query.c Tue Sep 25 09:55:21 2001 @@ -3272,7 +3272,8 @@ dns_rdatatype_format(rdataset->type, typename, sizeof(typename)); ns_client_log(client, NS_LOGCATEGORY_QUERIES, NS_LOGMODULE_QUERY, - level, "query: %s %s %s", namebuf, classname, typename); + level, "query: %s %s %s%s", namebuf, classname, typename, + WANTRECURSION(client) ? "+" : "-"); } void ! fi