Logging

為命名創建多個日誌流

  • October 22, 2020

我正在推出外部 DNS 伺服器以解決所有最終使用者查詢

在我們將解決方案投入生產之前,我希望盡可能多地進行有用的日誌記錄

這是 named.conf 文件(命名空間稱為 gi-named.conf 文件)

options {
       listen-on port 53 { Public IP; };
       #listen-on-v6 port 53 { ::1; };
       directory       "/var/named";
       dump-file       "/var/named/data/cache_dump.db";
       statistics-file "/var/named/data/named_stats.txt";
       memstatistics-file "/var/named/data/named_mem_stats.txt";
       recursing-file  "/var/named/data/named.recursing";
       secroots-file   "/var/named/data/named.secroots";
       allow-query     { any; };
       allow-query-on  { PublicIP; };

       /*
        - If you are building an AUTHORITATIVE DNS server, do NOT enable recursion.
        - If you are building a RECURSIVE (caching) DNS server, you need to enable
          recursion.
        - If your recursive DNS server has a public IP address, you MUST enable access
          control to limit queries to your legitimate users. Failing to do so will
          cause your server to become part of large scale DNS amplification
          attacks. Implementing BCP38 within your network would greatly
          reduce such attack surface
       */
       recursion yes;
       allow-query-cache { Internal Range; };
       allow-query-cache-on  { PublicIP; };



       query-source address Public IP ;

       dnssec-enable yes;
       dnssec-validation yes;

       /* Path to ISC DLV key */
       bindkeys-file "/etc/named.iscdlv.key";

       managed-keys-directory "/var/named/dynamic";

       pid-file "/run/named/named.pid";
       session-keyfile "/run/named/session.key";
};


logging
{
/*      If you want to enable debugging, eg. using the 'rndc trace' command,
*      named will try to write the 'named.run' file in the $directory (/var/named).
*      By default, SELinux policy does not allow named to modify the /var/named directory,
*      so put the default debug log file in data/ :
*/
       /*channel default_debug {
               print-time yes;
               print-category yes;
               print-severity yes;
               file "data/named.run";
               severity dynamic;
       };*/
       channel queries_log {
               file "/var/log/queries" versions 1 size 20m;
               print-time yes;
               print-category yes;
               print-severity yes;
               severity debug 3;
       };
       channel default_log {
          file "/var/named/log/default" versions 3 size 20m;
          print-time yes;
          print-category yes;
          print-severity yes;
          severity info;
   };
      channel query-errors_log {
          file "/var/named/log/query-errors" versions 5 size 20m;
          print-time yes;
          print-category yes;
          print-severity yes;
          severity dynamic;
   };

       category queries { queries_log; };
       category client { queries_log;  };
};

zone "." IN {
       type hint;
       file "named.ca";
};

include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";

我遇到的問題是,當我看到填充 /var/named/log/queries 文件的日誌時,我在 /var/named/log/query-error 日誌文件或 /var/named/log 中都看不到任何日誌/default 日誌文件,我不確定我到底哪裡出錯了,或者我是否遺漏了一些配置

任何人以前經歷過這種情況嗎?

所以問題似乎是我試圖創建的日誌文件和日誌通道在我使用的綁定版本中不可用。

我執行了 yum update bind-utils,它讓我進入了 9.11 版本。

自更新以來,所有日誌記錄通道都正常工作

引用自:https://serverfault.com/questions/1038967