Re: Bind Service & Script
Frank Crawford <[email protected]> Sat, 21 Apr 2018 16:04:01 +1000
| Newsgroups | gmane.comp.log.logwatch.devel |
|---|---|
| Message-ID | <[email protected]> |
--===============2679307955859705664==
Content-Type: multipart/alternative; boundary="=-CrFmpYY6Ts1zrtXIaPef"
--=-CrFmpYY6Ts1zrtXIaPef
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 8bit
Dennis,
Firstly, I would say that what you are logging there is an extension of
the standard logging in bind. While you have defined a new channel,
you haven't noted what categories are going there. The default_syslog
channel doesn't include category, severity or time, hence the default
logwatch module doesn't pick up those extra fields.
Anyway, you have two different items of concern, you can easily
configure logwatch to pickup the bind9 file by editing the appropriate
service configuration file.
Now, what is the appropriate service gets a bit more tricky. Firstly,
what do you expect it to report on that particular output? It looks
more like what you would dump doing debugging of queries, especially
since you have a 5Mb limit on the size, with 3 copies, so it would
rotate pretty quickly, and logwatch really is normally run on daily
logs, not transient logs.
Once you work out what you want to report, I'd argue that you still
want to use the named script, it already understands bind9 output (I
run it across my nameservers and it reports the operational issues
fine). You would probably want to add additional pattern matches
because, as you say, it doesn't currently match those lines. I can
guess some stats you may want, but that may be different to your
requirements.
If you can work out what you want I can suggest what you need to do to
get it reported, and then it can be rolled into the distribution.
RegardsFrank
On Thu, 2018-04-19 at 21:19 +0300, Klaipedaville on Google wrote:
>
> Hi Frank,
>
>
>
> Thank you for replying.
>
>
>
> Well, the "named module" that is the name script and service of
> Logwatch do
> not really parse the Bind9’s log files as I’ve mentioned in my first
> message
> before. Bind recommends custom logging because when you leave it
> "dropping"
> right into your syslog it does not really reflect the real picture so
> to speak.
> Now when you set it up as per Bind’s recommendations then there is
> nothing
> reported by Logwatch because there is nothing "dumped" into your
> syslog any more
> where Logwatch picks up "named module logging" from. That’s why I was
> asking if
> there were any work arounds to make Logwatch report on Bind9's?.. I
> thought that
> Bind’s script and service in Logwatch were required.. was I wrong?
> Thanks.
>
>
>
> Regards,
>
> Dennis
>
>
>
> P.S. I provided log examples in my first email to try to parse it /
> feed it
> through "named module"... it did not work my side...
>
>
>
>
>
>
>
>
>
>
> From: Frank Crawford
>
> Sent: Thursday, April 19, 2018 15:05
>
> To: Klaipedaville on Google ; logwatch-devel ; Orion Poplawski
>
> Subject: Re: [Logwatch-devel] Bind Service &
> Script
>
>
>
>
> Dennis,
>
> Isn't the "named" module what you need? It does look through
> /var/log/messages for the output, not a dedicated bind file, but
> still it is
> what I see for my DNS server output.
>
> Frank
>
> On Wed, 2018-04-18 at 17:28 +0300, Klaipedaville on Google wrote:
> >
> >
> > Hello everybody,
> >
> >
> >
> > I can’t believe it that the latest Logwatch 7.4.3 still does not
> > have any
> > Bind services and scripts. Am I wrong? I tried to "feed" bind9’s
> > regular log
> > files to named but it won’t parse them. Could anybody advise,
> > please on how to
> > make Logwatch "report" Bind? The standard / regular log files in
> > Bind9 are
> > setup like this:
> >
> >
> >
> > logging {
> >
> > channel bind_log {
> >
> > file "/var/log/bind/bind.log" versions 3 size 5m;
> >
> > severity info;
> >
> > print-category yes;
> >
> > print-severity yes;
> >
> > print-time yes;
> >
> > };
> >
> > };
> >
> >
> >
> > and what the logging produces as the outcome looks like this:
> >
> >
> >
> > 18-Apr-2018 11:36:14.961 queries: info: client 1.2.3.4#52132:
> > query:
> > ns2.barcap.com IN A + (1.2.3.4)
> >
> > 18-Apr-2018 11:36:14.961 queries: info: client 1.2.3.4#52132:
> > query:
> > a10-66.akam.net IN A + (1.2.3.4)
> >
> > 18-Apr-2018 11:36:14.962 queries: info: client 1.2.3.4#52132:
> > query:
> > a9-66.akam.net IN A + (1.2.3.4)
> >
> > 18-Apr-2018 11:36:14.962 queries: info: client 1.2.3.4#132:
> > query:
> > ns7.barcap.com IN A + (1.2.3.4)
> >
> > 18-Apr-2018 11:36:14.963 queries: info: client 1.2.3.4#52132:
> > query:
> > ns3.barcap.com IN A + (1.2.3.4)
> >
> > 18-Apr-2018 11:36:14.963 queries: info: client 1.2.3.4#52132:
> > query:
> > a1-71.akam.net IN A + (1.2.3.4)
> >
> > 18-Apr-2018 11:36:14.964 queries: info: client 1.12.3.4#52132:
> > query:
> > a12-64.akam.net IN A + (1.2.3.4)
> >
> >
> >
> > I would be really grateful for any pointers, suggestions,
> > recommendations, assistance.
> >
> >
> >
> > Many thanks in advance!
> >
> >
> >
> > Regards,
> >
> > Dennis
> >
> >
> >
> > -----------------------------------------------------------------
> > -------------
> > Check out the vibrant tech community on one of the world's most
> > engaging tech sites, Slashdot.org! http://sdm.link/slashdot________
> > _______________________________________
> > Logwatch-devel mailing list
> > [email protected]
> > https://lists.sourceforge.net/lists/listinfo/logwatch-devel
--=-CrFmpYY6Ts1zrtXIaPef
Content-Type: text/html; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
<html><head></head>
<body dir=3D"ltr"><div>Dennis,</div><div><br></div><div>Firstly, I would sa=
y that what you are logging there is an extension of the standard logging i=
n bind. While you have defined a new channel, you haven't noted what categ=
ories are going there. The default_syslog channel doesn't include category=
, severity or time, hence the default logwatch module doesn't pick up those=
extra fields.</div><div><br></div><div>Anyway, you have two different item=
s of concern, you can easily configure logwatch to pickup the bind9 file by=
editing the appropriate service configuration file.</div><div><br></div><d=
iv>Now, what is the appropriate service gets a bit more tricky. Firstly, w=
hat do you expect it to report on that particular output? It looks more li=
ke what you would dump doing debugging of queries, especially since you ha=
ve a 5Mb limit on the size, with 3 copies, so it would rotate pretty quickl=
y, and logwatch really is normally run on daily logs, not transient logs.</=
div><div><br></div><div>Once you work out what you want to report, I'd argu=
e that you still want to use the named script, it already understands bind9=
output (I run it across my nameservers and it reports the operational issu=
es fine). You would probably want to add additional pattern matches becaus=
e, as you say, it doesn't currently match those lines. I can guess some st=
ats you may want, but that may be different to your requirements.</div><div=
><br></div><div>If you can work out what you want I can suggest what you ne=
ed to do to get it reported, and then it can be rolled into the distributio=
n.</div><div><br></div><div>Regards</div><div>Frank</div><div><br></div><di=
v>On Thu, 2018-04-19 at 21:19 +0300, Klaipedaville on Google wrote:</div><b=
lockquote type=3D"cite" style=3D"margin:0 0 0 .8ex; border-left:2px #729fcf=
solid;padding-left:1ex">
<div dir=3D"ltr">
<div style=3D"FONT-SIZE: 12pt; FONT-FAMILY: 'Calibri'; COLOR: #000000">
<div>Hi Frank,</div>
<div> </div>
<div>Thank you for replying.</div>
<div> </div>
<div>Well, the "named module" that is the name script and service of Logwat=
ch do=20
not really parse the Bind9=E2=80=99s log files as I=E2=80=99ve mentioned in=
my first message=20
before. Bind recommends custom logging because when you leave it "dropping"=
=20
right into your syslog it does not really reflect the real picture so to sp=
eak.=20
Now when you set it up as per Bind=E2=80=99s recommendations then there is =
nothing=20
reported by Logwatch because there is nothing "dumped" into your syslog any=
more=20
where Logwatch picks up "named module logging" from. That=E2=80=99s why I w=
as asking if=20
there were any work arounds to make Logwatch report on Bind9's?.. I thought=
that=20
Bind=E2=80=99s script and service in Logwatch were required.. was I wrong? =
Thanks.</div>
<div> </div>
<div>Regards,</div>
<div>Dennis</div>
<div> </div>
<div>P.S. I provided log examples in my first email to try to parse it / fe=
ed it=20
through "named module"... it did not work my side...</div>
<div> </div>
<div> </div>
<div style=3D"FONT-SIZE: small; FONT-FAMILY: 'Calibri'; FONT-WEIGHT: normal=
; COLOR: #000000; FONT-STYLE: normal; TEXT-DECORATION: none; DISPLAY: inlin=
e">
<div style=3D"FONT: 10pt tahoma">
<div><font size=3D"3" face=3D"Calibri"></font> </div>
<div style=3D"BACKGROUND: #f5f5f5">
<div style=3D"font-color: black"><b>From:</b> <a title=3D"[email protected]=
u.id.au" href=3D"mailto:[email protected]">Frank Crawford</a> </div>
<div><b>Sent:</b> Thursday, April 19, 2018 15:05</div>
<div><b>To:</b> <a title=3D"[email protected]" href=3D"mailto:klaiped=
[email protected]">Klaipedaville on Google</a> ; <a title=3D"logwatch-devel@=
lists.sourceforge.net" href=3D"mailto:[email protected]"=
>logwatch-devel</a> ; <a title=3D"[email protected]" href=3D"mailto:orion@nwra=
.com">Orion Poplawski</a> </div>
<div><b>Subject:</b> Re: [Logwatch-devel] Bind Service &=20
Script</div></div></div>
<div> </div></div>
<div style=3D"FONT-SIZE: small; FONT-FAMILY: 'Calibri'; FONT-WEIGHT: normal=
; COLOR: #000000; FONT-STYLE: normal; TEXT-DECORATION: none; DISPLAY: inlin=
e">
<div>Dennis,</div>
<div> </div>
<div>Isn't the "named" module what you need? It does look through=20
/var/log/messages for the output, not a dedicated bind file, but still it i=
s=20
what I see for my DNS server output.</div>
<div> </div>
<div>Frank</div>
<div> </div>
<div>On Wed, 2018-04-18 at 17:28 +0300, Klaipedaville on Google wrote:</div=
>
<blockquote type=3D"cite" style=3D"margin:0 0 0 .8ex; border-left:2px #729f=
cf solid;padding-left:1ex">
<div dir=3D"ltr">
<div style=3D"FONT-SIZE: 12pt; FONT-FAMILY: 'Calibri'; COLOR: #000000">
<div>Hello everybody, </div>
<div> </div>
<div>I can=E2=80=99t believe it that the latest Logwatch 7.4.3 still does=
not have any=20
Bind services and scripts. Am I wrong? I tried to "feed" bind9=E2=80=99s =
regular log=20
files to named but it won=E2=80=99t parse them. Could anybody advise, ple=
ase on how to=20
make Logwatch "report" Bind? The standard / regular log files in Bind9 ar=
e=20
setup like this:</div>
<div> </div>
<div>logging {</div>
<div>channel bind_log {</div>
<div>file "/var/log/bind/bind.log" versions 3 size 5m;</div>
<div>severity info;</div>
<div>print-category yes;</div>
<div>print-severity yes;</div>
<div>print-time yes;</div>
<div> };</div>
<div>};</div>
<div> </div>
<div>and what the logging produces as the outcome looks like this:</div>
<div> </div>
<div>18-Apr-2018 11:36:14.961 queries: info: client 1.2.3.4#52132: query:=
=20
ns2.barcap.com IN A + (1.2.3.4)</div>
<div>18-Apr-2018 11:36:14.961 queries: info: client 1.2.3.4#52132: query:=
=20
a10-66.akam.net IN A + (1.2.3.4)</div>
<div>18-Apr-2018 11:36:14.962 queries: info: client 1.2.3.4#52132: query:=
=20
a9-66.akam.net IN A + (1.2.3.4)</div>
<div>18-Apr-2018 11:36:14.962 queries: info: client 1.2.3.4#132: query:=
=20
ns7.barcap.com IN A + (1.2.3.4)</div>
<div>18-Apr-2018 11:36:14.963 queries: info: client 1.2.3.4#52132: query:=
=20
ns3.barcap.com IN A + (1.2.3.4)</div>
<div>18-Apr-2018 11:36:14.963 queries: info: client 1.2.3.4#52132: query:=
=20
a1-71.akam.net IN A + (1.2.3.4)</div>
<div>18-Apr-2018 11:36:14.964 queries: info: client 1.12.3.4#52132: query=
:=20
a12-64.akam.net IN A + (1.2.3.4)</div>
<div> </div>
<div>I would be really grateful for any pointers, suggestions,=20
recommendations, assistance.</div>
<div> </div>
<div>Many thanks in advance!</div>
<div> </div>
<div>Regards,</div>
<div>Dennis</div>
<div>
<div style=3D"FONT-SIZE: small; FONT-FAMILY: 'Calibri'; FONT-WEIGHT: norm=
al; COLOR: #000000; FONT-STYLE: normal; TEXT-DECORATION: none; DISPLAY: inl=
ine"></div> </div></div></div><pre>-----------------------------------=
-------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! <a href=3D"http://sdm.link/slashdot">htt=
p://sdm.link/slashdot</a></pre><pre>_______________________________________=
________
Logwatch-devel mailing list
<a href=3D"mailto:[email protected]">Logwatch-devel@list=
s.sourceforge.net</a>
<a href=3D"https://lists.sourceforge.net/lists/listinfo/logwatch-devel">htt=
ps://lists.sourceforge.net/lists/listinfo/logwatch-devel</a>
</pre></blockquote></div></div></div>
</blockquote></body></html>
--=-CrFmpYY6Ts1zrtXIaPef--
--===============2679307955859705664==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot
--===============2679307955859705664==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
_______________________________________________
Logwatch-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/logwatch-devel
--===============2679307955859705664==--