Bind9 – Creating Special Query Log for a Certain Zone

binddomain-name-systemlogging

How do I make special query log file from a certain zone.

While my current log config is

logging {
        channel query_logging {
                file "/var/log/named/query.log" versions 5>
                //severity debug 1;
                print-time yes;
                //print-severity yes;
                //print-category yes;
        };

        category queries {
                query_logging;
        };
};

That config is logging all queries from any zone and save it to one file. What I want is I want record for specify zone and save the log to specify file.

For example zone example.com.

So for any query line that contain example.com word will saved to specify file.

Note: my zone is encapsulated by view.

If bind can't handle it, maybe regex can do it? But how save the regex result to a file periodically? I'm wonder it will be waste CPU resource if use regex.

Best Answer

You can't.

But you could forward all logging to SyslogNG or equivalent where you have full regex capability to split a given stream in multiple files or other sinks.

PS: maybe the feature exists in other nameservers, do you have any specific reason to consider only bind?

Related Topic