DNS 로깅 처리

https://scbyun.com/entry/BINDnamed%EC%9D%98-%EB%A1%9C%EA%B9%85%EC%9D%84-%EC%84%A4%EC%A0%95%ED%95%98%EB%8A%94-%EB%B0%A9%EB%B2%95bind-logging

BIND(named)의 로깅을 설정하는 방법(bind logging)

# 로깅 파일 생성
cd /etc/bind
vi named.logging.conf
------------------------
logging {
  channel default_syslog {
    syslog local2;
    severity debug;
  };
  channel default_syslog {
    file "/var/log/named/default.log" versions 3 size 20m;
    severity debug;
    print-category yes;
    print-severity yes;
    print-time yes;
  };
  category default {
    default_syslog;
  };
  category general {
    general_syslog;
  };  
------------------------

# 환경설정에 추가
vi named.conf
------------------------
include "/etc/bind/named.logging.conf";
------------------------

# 재기동
sudo systemctl restart named

'category: queries'를 활용해서 count를 계산할 수 있음(자기 자신에서 호출하는 부분은 확인 안됨)

Trouble Shooting

• Job for named.service failed because the control process exited with error code.

# 실행
# logging 추가후, 실행
----------------------------------
logging {
  channel simple_log {
    file "/var/log/named/bind.log" versions 3 size 5m;
    severity warning;
    print-time yes;
    print-severity yes;
    print-category yes;
  };
  category default {
    simple_log;
  };
};
----------------------------------

sudo systemctl restart named

# 에러
Job for named.service failed because the control process exited with error code.
See "systemctl status named.service" and "journalctl -xeu named.service" for details.

# 원인 파악
cd /var/log
tail -f syslog
---------------------------------------------
 isc_stdio_open '/var/log/named/bind.log' failed: file not found
---------------------------------------------

# 파일 권한 문제
# 셋팅을 원래대로 돌리고 작동시킨 다음에 확인
ps -ef | grep named
----------------------------
bind     2743890       1  0 20:43 ?        00:00:00 /usr/sbin/named -u bind
----------------------------

cd /var/log
sudo mkdir named
sudo chown bind:bind named
sudo systemctl restart named