bind8_query2dlf1

Usage

Overview

This script converts each line in a bind8 querylog to a dns dlf record.

BIND generates these logs when something like

 logging {
     channel query_logging {
         file "/var/log/named_querylog"
         versions 3 size 100M;
         print-time yes;                 // timestamp log entries              
      };
      category queries {
          query_logging;
      };
 };

is in bind's named.conf. This will save up to three logfiles of maximum 100 megabytes in the directory /var/log.

These logfiles look like:

 10-Apr-2000 00:01:20.307 XX /10.2.3.4/1.2.3.in-addr.arpa/SOA/IN
 10-Apr-2000 00:01:20.308 XX+/10.4.3.2/host.foo.com/A/IN

Examples

To process a log as produced by bind8:

 $ bind8_query2dlf < dns-query

bind8_query2dlf will be rarely used on its own, but is more likely called by lr_log2report:

 $ lr_log2report bind8_query < /var/log/dns-query

Version

$Id: bind8_query2dlf.in,v 1.6 2006/07/23 13:16:33 vanbaal Exp $