# Introduction

By default, logs from named are sent to /var/log/syslog via syslog.

## Goals

- Make BIND log more useful information

## Notes

- Commands preceded with “$” imply that you should execute the command as a general user - not as root.
- Commands preceded with “#” imply that you should be working as root.
- Commands with more specific command lines (e.g. “rtrX>” or “mysql>”) imply that you are executing commands on remote equipment, or within another program.

## Create a log directory

On SOA (soa.grpX):

1. Create the log directory:

    $ sudo mkdir -p /var/log/bind
    $ sudo chown bind /var/log/bind

## Edit /etc/bind/named.conf.options

    $ sudo editor /etc/bind/named.conf.options

Now move to the bottom (end) of the file, and add the following logging section:

    logging {
            channel transfers {
                file "/var/log/bind/transfers" versions 3 size 10M;
                print-time yes;
                severity info;
            };
            channel notify {
                file "/var/log/bind/notify" versions 3 size 10M;
                print-time yes;
                severity info;
            };
            channel dnssec {
                file "/var/log/bind/dnssec" versions 3 size 10M;
                print-time yes;
                severity info;
            };
            channel query {
                file "/var/log/bind/query" versions 5 size 10M;
                print-time yes;
                severity info;
            };
            channel general {
                file "/var/log/bind/general" versions 3 size 10M;
            print-time yes;
            severity info;
            };
        channel slog {
            syslog security;
            severity info;
        };
            category xfer-out { transfers; slog; };
            category xfer-in { transfers; slog; };
            category notify { notify; };

            category lame-servers { general; };
            category config { general; };
            category default { general; };
            category security { general; slog; };
            category dnssec { dnssec; };

            // category queries { query; };
    };

Save and exit the file, and TEST that it works:

    $ sudo named-checkconf /etc/bind/named.conf

Note that the “queries” category is commented out. This is on purpose as this log file on many servers could become very large quickly.

## Update AppArmor rules (skip this step if AppArmor isn’t installed on your system)

By default, writing fies to `/var/log/bind` won’t be allowed by the AppArmor security system. To work around this, we’ll update the Ubuntu AppArmor profile for named (bind9):

    $ sudo editor /etc/apparmor.d/usr.sbin.named

Find this section:

      # /etc/bind should be read-only for bind
      # /var/lib/bind is for dynamically updated zone (and journal) files.
      # /var/cache/bind is for slave/stub data, since we're not the origin of it.
      # See /usr/share/doc/bind9/README.Debian.gz
      /etc/bind/** r,
      /var/lib/bind/** rw,
      /var/lib/bind/ rw,
      /var/cache/bind/** lrw,
      /var/cache/bind/ rw,

And, immediately after the last line in that block (/var/cache/bind/ rw,), add:

      /var/log/bind/** rw,
      /var/log/bind/ rw,

Save the file and exit, then reload AppArmor:

    $ sudo systemctl restart apparmor

## Now reconfig or restart bind:

    $ sudo rndc reconfig

- Look into /var/log/bind/, and see if the files get created. (e.g., `ls -lt /var/log/bind/`)

If it doesn’t work, try:

- check permissions for `/var/log/bind`
- restarting named (`service bind9 restart`)

## Do a zone transfer of your own domain:

    $ dig @10.X.1.1 AXFR MYTLD

- Verify that the transfer shows up in /var/log/bind/transfers:

    17-Feb-2016 11:18:15.331 client 10.X.1.1#61235: transfer of 'MYTLD/IN': AXFR started
    17-Feb-2016 11:18:15.331 client 10.X.1.1#61235: transfer of 'MYTLD/IN': AXFR ended

Try and do an AXFR for a non-existent zone:

    $ dig @10.X.1.1 AXFR xyzxyz

… check `/var/log/bind/transfers again` - what do you see ?

## Update the serial number on your master zone file:

    $ sudo editor /etc/bind/zones/mytld/mytld

Increment Serial by 1 then save the zone file.

    $ sudo rndc reload MYTLD

Look in the notify log file.

    $ tail -100 /var/log/bind/notify

There should be a line that `ooks something like this:

    22-Feb-2016 23:43:48.647 zone MYTLD/IN: sending notifies (serial 2018022306)

## Optional - view queries

    Remove the `//` from the front of `category queries { query; };`
    in `named.conf` and restart the nameserver

    $ sudo  service bind9 restart

Then start monitoring the query file

    $ sudo tail -F /var/log/bind/query

While that is running, in another terminal window or on someone else’s machine, execute a `dig`.

    # dig @10.X.1.1 www.MYTLD.

You should see the query in the logfile.

Your should re-enable the `//` in front of “category queries { query; };” and restart bind to keep the logs from filling up.