Bind log configuration

[kholikt]

Hi,

I am using the latest version of Bind download from software depot. In my DNS I restricted recursive query to only certain hosts.

I configured the query log to a separate file

channel query_files {
file "/var/adm/bind/queries" size 100M;
severity dynamic;
print-time yes;
};

The problem is there any way for me to log those recursive query that was blocked to a separate file because from the log I can distinguish which source IP has done a successful recursive query?

[Bejoy C Alias]

U can create a separate channel to log the categories of 'security' . The security category contains Approval and denial of requests , which will contain those blocked requests .

channel blocked {
file "/var/log/blocked.log" versions 10 size 20m;
print-category yes;
print-severity yes;
print-time yes;
};
category security {
blocked;
};

[kholikt]

After I done that the blocked recursive query still didn't go to the security file and mix up with queries file.

[Bejoy C Alias]

When u dig up a recursive query from a blocked client what u r getting in the status field of ur answer . Can u attach ur full named.conf file ?