1. Monitoring with logging
BIND has a very flexible and configurable logging system
channel defines where log information should go
Can use custom channel or user one of four predefined channels
category defines what should be logged
All log messages are divided into one of fifteen categories.
A category directive will be used to determine to which channels log messages should be directed.
Messages in one category may be directed to multiple channels
2019/5/7
Cryptography

2. channel channel defines target for logs
Can syslog to any facility or use a file
Channels allow you to filter by message severity
Similar to syslog severity
critical error warning notice info debug [level] dynamic
debug and dynamic are unique to BIND
default is info
2019/5/7
Cryptography

3. Additional options for verbose output
print-severity
log the severity level of messages
print-category
log the category of messages
print-time
log the date and timeof messages
Note: syslog() already records this information
Four predefined channels are:
channel “default_syslog” { syslog daemon; severity info; }
channel “default_debug” { file “named.run”; severity dynamic; }
channel “default_stderr” { stderr; severity info; };
channel “null” { null; };
2019/5/7
Cryptography

4. category
category statement associates a category with a channel for logging
Fifteen categories to choose from
default Defines default channel for categories
general Catch-all category for unclassified messages
client Client request problems
config Configuration file problems
dispatch Dispatch of inbound packets to internal server modules
dnssec DNSSEC and TSIG
lame-servers Problems due to remote server misconfiguration
network Related to network operations
notify NOTIFY announcements
queries Query processing
resolver Recursive query processing
security Accepted or denied requests
update Dynamic updates
xfer-in Zone transfers received by the server
xfer-out Zone transfers sent by the server
2019/5/7
Cryptography

5. An example logging { channel my_file { }; channel my_syslog {
file "log.msgs" versions 3 size 10k;
severity dynamic; };
channel my_syslog {
syslog local0;
severity info;
category xfer-in { my_file; };
category update { my_syslog; };
2019/5/7
Cryptography

6. The logging Statement
If you specify unlimited versions, BIND will keep 99 versions.
If you specify a maximum file size, the nameserver stops writing to the file after it reaches the specified size. Unlike the versions substatement (mentioned in the last paragraph), the file is not rolled over and a new file opened when the specified size is reached. The nameserver just stops writing to the file. If you do not specify a file size, the file grows indefinitely.
If a channel goes to syslog, you can specify the facility to be any of the following: kern, user, mail, daemon, auth, syslog, lpr, news, uucp, cron, authpriv, ftp, local0, local1, local2, local3, local4, local5, local6, or local7. The default is daemon, and we recommend that you either use that or one of the local facilities.
2019/5/7
Cryptography

7. 定义一个channel，要求使用file来记录日志，滚动数目为10，每个最大为10M 级别为dynamic 要求记录额外信息；
2019/5/7
Cryptography

8. logging { channel “query_log” { }; category queries { query_log; };
file “/var/log/bind9/query.log” versions 10 size 10M;
severity dynamic;
print-category yes;
print-severity yes;
print-time yes; };
category queries { query_log; };
2019/5/7
Cryptography

9. category default { error_log; };
channel error_log {
file /var/log/bind9/error.log versions 10 size 1M;
severity error;
print-severity yes;
print-category yes;
print-time yes; };
category default { error_log; };
2019/5/7
Cryptography