dns.bind

The tags beginning with dns.bind identify log events generated by the BIND Name Server.  The BIND Name Server generates log messages associated with BIND categories. Devo's dns.bind tags are designed to collect all messages in the queries category messages in one place, and the rest of the messages in another.

This article covers the following topics:

Tag structure

The full tag will have just three levels. The first two are fixed as dns.bind. The third level describes the event message content in terms of the event's BIND category and must be either query or info. Query events are all those log messages in the queries BIND category. Events with any other BIND category value are assigned info as the third tag level.

Therefore, the valid tags include:

• dns.bind.query
• dns.bind.info

For more information, read more about Devo tags.

BIND logging

You need to configure BIND to log messages in the queries category to one log file and the rest of the messages to another file. The following excerpt from a BIND configuration file shows how this can be done. 

logging {
        channel querylog {
                        file "/var/log/bind/query.log";
                        severity info;    # Only send events of level "info" or higher
                        print-category yes;
                        print-time yes;
                        print-severity yes;
                        };
        channel defaultlog {
                        file "/var/log/bind/bind.log";
                        print-time yes;
                        print-severity yes;
                        print-category yes;
                        };
        category default { defaultlog; };
        category queries { querylog; };
        category lame-servers { null; };
};

You should also make sure that the user running bind has read and write permissions on the directory and generated log files. 

Also, if you are using modules like AppArmor or SELinux, make sure there is an exception for /var/log/bind/*.

Sending to Devo using rsyslog

You can read more about using rsyslog to monitor and send files to a Devo endpoint in the Sending data to Devo section of our documentation. Here we offer a sample rsyslog configuration file that is set up to monitor the query and bind logs and forward them to a Devo Relay.

$template named,"<%PRI%>%timegenerated% %HOSTNAME% %syslogtag% %msg%"
 
# File access
$InputFileName /var/log/bind/query.log
$InputFileTag dns.bind.query:  
$InputFileStateFile stat-file1-namedquerylog
$InputFileSeverity info
$InputFileFacility local7
$InputFilePollInterval 1
$InputFilePersistStateInterval 1
$InputRunFileMonitor
 
# File access
$InputFileName /var/log/bind/bind.log
$InputFileTag dns.bind.info:
$InputFileStateFile stat-file1-namedinfolog
$InputFileSeverity info
$InputFileFacility local7
$InputFilePollInterval 1
$InputFilePersistStateInterval 1
$InputRunFileMonitor
 
# SSL config for DEVO Cloud
#$DefaultNetstreamDriver gtls # use gtls netstream driver
#$DefaultNetstreamDriverCAFile /etc/rsyslog.d/ca.crt
#$DefaultNetstreamDriverCertFile /etc/rsyslog.d/user.crt
#$DefaultNetstreamDriverKeyFile /etc/rsyslog.d/user.key
#$ActionSendStreamDriverMode 1 # require TLS for the connection
#$ActionSendStreamDriverAuthMode x509/name
#$ActionSendStreamDriverPermittedPeer collector
 
if $syslogtag contains 'dns.bind.' and $syslogfacility-text == 'local7' then @@DEVO-RELAY:PORT;named
:syslogtag, contains, "dns.bind." ~

DEVO-RELAY and PORT are placeholders which you should replace with the IP address and port of your Devo Relay. Or, to send the events directly to the Devo Cloud, you can uncomment the SSL section of the file. In this case, you should replace DEVO-RELAY and PORT with the hostname of your Devo domain and port 443. 

Finally, make sure the user running rsyslog has read permissions on the directory and the log files generated by BIND.

Related articles

• Using rsyslog to send data to Devo