DNS Lookup Logging

[Donald Rider]

Greetings-

I have a client with a couple of DNS servers running HP-UX 10.20 with BIND 4.9.7. They have asked me to set up a log that will record DNS lookups, similar to the log extract below. We currently log stats and errors in the syslog, but not lookup transactions. I'm having trouble finding information on how to do this in BIND 4, and was wondering if this is possible at all, and if it is, how to set it up.

Thanks for your time.

Rcv 172.20.57.57 0022 Q [0001 D NOERROR]
(2)m2(11)doubleclick(3)net(0)
Rcv 172.20.57.57 0022 Q [0001 D NOERROR]
(2)m2(11)doubleclick(3)net(0)
Rcv 172.20.66.79 0001 Q [0001 D NOERROR]
(2)66(2)20(3)172(7)in-addr(4)arpa(0)
Rcv 172.20.22.71 000d Q [0001 D NOERROR]
(2)22(2)20(3)172(7)in-addr(4)arpa(0)
Rcv 172.20.10.180 022f Q [0001 D NOERROR]
(5)home2(8)netscape(3)com(0)
Rcv 172.20.46.57 09b3 Q [0001 D NOERROR]

[Jeff Schussele]

Hi Donald,

Not positive, but fairly sure, you cannot log to that level w/BIND 4.
May need to step up to BIND 8, which can log pretty much anything that disk space will allow.

Rgds,
Jeff

[Steven Sim Kok Leong]

Hi,

Alternatively, perform it at the TCP/IP level i.e. use tcpdump at your DNS server to log all inbound UDP/TCP port 53 traffic and outbound UPD/TCP port 53 traffic.

tcpdump will give you all the details you need. ;-)

Hope this helps. Regards.

Steven Sim Kok Leong

[Donald Rider]

Steven,

Thanks for your help.

I'm only vaguely familiar with tcpdump. Can you explain to me how I would use it to grab that information?

Thanks...

[Donald Rider]

Actually, scratch that.

A co-worker elsewhere in my building answered my question. BIND has an option in the boot file to turn on query logging, if you have a capacious /var filesystem.

Just add the line

options query-log

to your named boot file, restart named, and you're all set.

Thanks for your help.