- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Printer Friendly Page
isc bind query logs
- Mark as New
- Bookmark
- Subscribe
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
03-29-2019 02:08 AM
What is the use of isc bind query logs and how to interpret that logs?
Solved! Go to Solution.
Re: isc bind query logs
[ Edited ]- Mark as New
- Bookmark
- Subscribe
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
03-29-2019 06:07 AM - edited 06-27-2023 02:19 PM
Hello Guys,
This log represents an ‘event’ which was generated as a result of a DNS request initiated by a client & that’s pretty much its use-case. It is represented as ‘query’ in the server’s logging category & in a busy DNS environment with massive QPS numbers, Infoblox typically would advise to have this category to be turned off. That’s considering the performance impact on the server due to this extra job – pulls resources. Here’s a detailed info about it as requested :
Example :
29-Mar-2019 07:35:14.790 client 10.120.21.39#35910: query: google.com IN MX + (10.35.101.18)
29-Mar-2019 07:16:18.877 client 10.36.148.6#52197: view 1: query: whatever.com IN TXT + (10.35.101.18)
Fields explained based on the example above :
Field name | Data Format/Data example | Comments |
Date | dd-Mmm-yyyy | This date/time is in host-local timezone |
Time | hh:mm:ss.ms | This date/time is in host-local timezone |
Client | 'client' 10.120.21.39#52864 | literal string 'client' followed by client ipaddress#port |
View | 'view' [0-9]':' | optional field. If view is default, it's omitted |
Query-start | 'query:' | literal string 'query:' |
Query-name | cnn.com | |
Query-class | 'IN' | Always 'IN' |
Query-type | (A|AAAA|PTR|TXT|...) | Queried resource record type |
Query-flags | [+-]SETDC '+-' - '+' want recursion, '-' otherwise | A sequence of letters which code query flags. |
Query-server | '('10.35.101.18')' | Ip addres of the server which received this request |
I hope that’ll address your question.
Best regards.