Re: Bind Service & Script
"Klaipedaville on Google" <[email protected]> Sat, 21 Apr 2018 15:27:15 +0300
| Newsgroups | gmane.comp.log.logwatch.devel |
|---|---|
| Message-ID | <FE4CBE0500E840279DD05D0D68586429@Computer> |
This is a multi-part message in MIME format.
--===============7999700047746330126==
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_004A_01D3D985.3A5B8330"
This is a multi-part message in MIME format.
------=_NextPart_000_004A_01D3D985.3A5B8330
Content-Type: text/plain;
charset="utf-8"
Content-Transfer-Encoding: quoted-printable
Hi Frank,
Thank you so much for your replying. I appreciate.
Well, I would like it simply to report on errors, denied queries, =
security, unexpected RCODEs, and refused connections both ways because =
right now it does not report anything at all when I type the following =
for example:
logwatch --detail high --service name --range all
As you can see I ask it to advise me on all the entries there are out =
there, not only daily ones, but alas, there is nothing reported, no =
extension of its standard logging reported, no any other output reported =
at all. I have not deleted any of my log files at all yet but it still =
won=E2=80=99t pick them up. I also typed =E2=80=93range all, --range =
today, --range yesterday and so on and so forth which should have =
reported at least something but it does not happen. Thus, I assumed that =
the "name" script and service found in Logwatch could not really read =
and parse Bind9=E2=80=99s log files.=20
I specified of course my custom log files in Logwatch, that is I set the =
path in my copy of named.conf to be like this in ../logfiles:
LogFile =3D /var/log/bind/bind.log
and I also defined it in my copy of named.conf in ../services to read my =
bind.log file like this:
LogFile =3D bind
I've also configured different scripts and services of Logwatch before =
and they have been running perfectly well, with the only exception that =
they were the "exact" ones so speak. For instance I customized dovecot =
for dovecot, proftpd for proftpd, spamassassin for spamassassin and so =
on but here we have to customize the named for bind9 which in my =
understanding might be totally different and may require this named =
script=E2=80=99s and service=E2=80=99s thorough re-writing (completely =
new script?). However, I am glad you are saying I am all wrong and I =
would be thankful if you could assist me.
It would be also nice to take a look at your bind9=E2=80=99s logging =
example, the output it generates, and the output your named creates out =
of it when it's parsed.
Many thanks in advance!
Regards,
Dennis
From: Frank Crawford=20
Sent: Saturday, April 21, 2018 09:04
To: Klaipedaville on Google ; logwatch-devel ; Orion Poplawski=20
Subject: Re: [Logwatch-devel] Bind Service & Script
Dennis,
Firstly, I would say that what you are logging there is an extension of =
the standard logging in bind. While you have defined a new channel, you =
haven't noted what categories are going there. The default_syslog =
channel doesn't include category, severity or time, hence the default =
logwatch module doesn't pick up those extra fields.
Anyway, you have two different items of concern, you can easily =
configure logwatch to pickup the bind9 file by editing the appropriate =
service configuration file.
Now, what is the appropriate service gets a bit more tricky. Firstly, =
what do you expect it to report on that particular output? It looks more =
like what you would dump doing debugging of queries, especially since =
you have a 5Mb limit on the size, with 3 copies, so it would rotate =
pretty quickly, and logwatch really is normally run on daily logs, not =
transient logs.
Once you work out what you want to report, I'd argue that you still want =
to use the named script, it already understands bind9 output (I run it =
across my nameservers and it reports the operational issues fine). You =
would probably want to add additional pattern matches because, as you =
say, it doesn't currently match those lines. I can guess some stats you =
may want, but that may be different to your requirements.
If you can work out what you want I can suggest what you need to do to =
get it reported, and then it can be rolled into the distribution.
Regards
Frank
On Thu, 2018-04-19 at 21:19 +0300, Klaipedaville on Google wrote:
Hi Frank,
Thank you for replying.
Well, the "named module" that is the name script and service of =
Logwatch do not really parse the Bind9=E2=80=99s log files as =
I=E2=80=99ve mentioned in my first message before. Bind recommends =
custom logging because when you leave it "dropping" right into your =
syslog it does not really reflect the real picture so to speak. Now when =
you set it up as per Bind=E2=80=99s recommendations then there is =
nothing reported by Logwatch because there is nothing "dumped" into your =
syslog any more where Logwatch picks up "named module logging" from. =
That=E2=80=99s why I was asking if there were any work arounds to make =
Logwatch report on Bind9's?.. I thought that Bind=E2=80=99s script and =
service in Logwatch were required.. was I wrong? Thanks.
Regards,
Dennis
P.S. I provided log examples in my first email to try to parse it / =
feed it through "named module"... it did not work my side...
From: Frank Crawford=20
Sent: Thursday, April 19, 2018 15:05
To: Klaipedaville on Google ; logwatch-devel ; Orion Poplawski=20
Subject: Re: [Logwatch-devel] Bind Service & Script
Dennis,
Isn't the "named" module what you need? It does look through =
/var/log/messages for the output, not a dedicated bind file, but still =
it is what I see for my DNS server output.
Frank
On Wed, 2018-04-18 at 17:28 +0300, Klaipedaville on Google wrote:
Hello everybody, =20
I can=E2=80=99t believe it that the latest Logwatch 7.4.3 still does =
not have any Bind services and scripts. Am I wrong? I tried to "feed" =
bind9=E2=80=99s regular log files to named but it won=E2=80=99t parse =
them. Could anybody advise, please on how to make Logwatch "report" =
Bind? The standard / regular log files in Bind9 are setup like this:
logging {
channel bind_log {
file "/var/log/bind/bind.log" versions 3 size 5m;
severity info;
print-category yes;
print-severity yes;
print-time yes;
};
};
and what the logging produces as the outcome looks like this:
18-Apr-2018 11:36:14.961 queries: info: client 1.2.3.4#52132: query: =
ns2.barcap.com IN A + (1.2.3.4)
18-Apr-2018 11:36:14.961 queries: info: client 1.2.3.4#52132: query: =
a10-66.akam.net IN A + (1.2.3.4)
18-Apr-2018 11:36:14.962 queries: info: client 1.2.3.4#52132: query: =
a9-66.akam.net IN A + (1.2.3.4)
18-Apr-2018 11:36:14.962 queries: info: client 1.2.3.4#132: query: =
ns7.barcap.com IN A + (1.2.3.4)
18-Apr-2018 11:36:14.963 queries: info: client 1.2.3.4#52132: query: =
ns3.barcap.com IN A + (1.2.3.4)
18-Apr-2018 11:36:14.963 queries: info: client 1.2.3.4#52132: query: =
a1-71.akam.net IN A + (1.2.3.4)
18-Apr-2018 11:36:14.964 queries: info: client 1.12.3.4#52132: =
query: a12-64.akam.net IN A + (1.2.3.4)
I would be really grateful for any pointers, suggestions, =
recommendations, assistance.
Many thanks in advance!
Regards,
Dennis
=20
-------------------------------------------------------------------------=
-----
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! =
http://sdm.link/slashdot_______________________________________________
Logwatch-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/logwatch-devel
------=_NextPart_000_004A_01D3D985.3A5B8330
Content-Type: text/html;
charset="utf-8"
Content-Transfer-Encoding: quoted-printable
<HTML><HEAD></HEAD>
<BODY dir=3Dltr>
<DIV dir=3Dltr>
<DIV style=3D"FONT-SIZE: 12pt; FONT-FAMILY: 'Calibri'; COLOR: #000000">
<DIV>Hi Frank,</DIV>
<DIV> </DIV>
<DIV>Thank you so much for your replying. I appreciate.</DIV>
<DIV> </DIV>
<DIV>Well, I would like it simply to report on errors, denied queries, =
security,=20
unexpected RCODEs, and refused connections both ways because right now =
it does=20
not report anything at all when I type the following for example:</DIV>
<DIV> </DIV>
<DIV>logwatch --detail high --service name --range all</DIV>
<DIV> </DIV>
<DIV>As you can see I ask it to advise me on all the entries there are =
out=20
there, not only daily ones, but alas, there is nothing reported, no =
extension of=20
its standard logging reported, no any other output reported at all. I =
have not=20
deleted any of my log files at all yet but it still won=E2=80=99t pick =
them up. I also=20
typed =E2=80=93range all, --range today, --range yesterday and so on and =
so forth which=20
should have reported at least something but it does not happen. Thus, I =
assumed=20
that the "name" script and service found in Logwatch could not really =
read and=20
parse Bind9=E2=80=99s log files. </DIV>
<DIV> </DIV>
<DIV>I specified of course my custom log files in Logwatch, that is I =
set the=20
path in my copy of named.conf to be like this in ../logfiles:</DIV>
<DIV> </DIV>
<DIV>LogFile =3D /var/log/bind/bind.log</DIV>
<DIV> </DIV>
<DIV>and I also defined it in my copy of named.conf in ../services to =
read my=20
bind.log file like this:</DIV>
<DIV> </DIV>
<DIV>LogFile =3D bind</DIV>
<DIV> </DIV>
<DIV>I've also configured different scripts and services of Logwatch =
before and=20
they have been running perfectly well, with the only exception that they =
were=20
the "exact" ones so speak. For instance I customized dovecot for =
dovecot,=20
proftpd for proftpd, spamassassin for spamassassin and so on but here we =
have to=20
customize the named for bind9 which in my understanding might be totally =
different and may require this named script=E2=80=99s and =
service=E2=80=99s thorough re-writing=20
(completely new script?). However, I am glad you are saying I am all =
wrong and I=20
would be thankful if you could assist me.</DIV>
<DIV> </DIV>
<DIV>It would be also nice to take a look at your bind9=E2=80=99s =
logging example, the=20
output it generates, and the output your named creates out of it when =
it's=20
parsed.</DIV>
<DIV> </DIV>
<DIV>Many thanks in advance!</DIV>
<DIV> </DIV>
<DIV>Regards,</DIV>
<DIV>Dennis</DIV>
<DIV> </DIV>
<DIV>
<DIV=20
style=3D"FONT-SIZE: small; FONT-FAMILY: 'Calibri'; FONT-WEIGHT: normal; =
COLOR: #000000; FONT-STYLE: normal; TEXT-DECORATION: none; DISPLAY: =
inline"><FONT=20
size=3D3 face=3DCalibri></FONT></DIV>
<DIV style=3D"FONT: 10pt tahoma">
<DIV style=3D"BACKGROUND: #f5f5f5">
<DIV style=3D"font-color: black"><B>From:</B> <A =
[email protected]=20
href=3D"mailto:[email protected]">Frank Crawford</A> </DIV>
<DIV><B>Sent:</B> Saturday, April 21, 2018 09:04</DIV>
<DIV><B>To:</B> <A [email protected]=20
href=3D"mailto:[email protected]">Klaipedaville on Google</A> ; <A =
title=3Dlogwatch-devel-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org=20
href=3D"mailto:[email protected]">logwatch-devel</A> =
; <A=20
[email protected] href=3D"mailto:[email protected]">Orion =
Poplawski</A> </DIV>
<DIV><B>Subject:</B> Re: [Logwatch-devel] Bind Service &=20
Script</DIV></DIV></DIV>
<DIV> </DIV></DIV>
<DIV=20
style=3D"FONT-SIZE: small; FONT-FAMILY: 'Calibri'; FONT-WEIGHT: normal; =
COLOR: #000000; FONT-STYLE: normal; TEXT-DECORATION: none; DISPLAY: =
inline">
<DIV>Dennis,</DIV>
<DIV> </DIV>
<DIV>Firstly, I would say that what you are logging there is an =
extension of the=20
standard logging in bind. While you have defined a new channel, you =
haven't=20
noted what categories are going there. The default_syslog channel =
doesn't=20
include category, severity or time, hence the default logwatch module =
doesn't=20
pick up those extra fields.</DIV>
<DIV> </DIV>
<DIV>Anyway, you have two different items of concern, you can easily =
configure=20
logwatch to pickup the bind9 file by editing the appropriate service=20
configuration file.</DIV>
<DIV> </DIV>
<DIV>Now, what is the appropriate service gets a bit more tricky. =
Firstly, what=20
do you expect it to report on that particular output? It looks more like =
what=20
you would dump doing debugging of queries, especially since you have a =
5Mb limit=20
on the size, with 3 copies, so it would rotate pretty quickly, and =
logwatch=20
really is normally run on daily logs, not transient logs.</DIV>
<DIV> </DIV>
<DIV>Once you work out what you want to report, I'd argue that you still =
want to=20
use the named script, it already understands bind9 output (I run it =
across my=20
nameservers and it reports the operational issues fine). You would =
probably want=20
to add additional pattern matches because, as you say, it doesn't =
currently=20
match those lines. I can guess some stats you may want, but that may be=20
different to your requirements.</DIV>
<DIV> </DIV>
<DIV>If you can work out what you want I can suggest what you need to do =
to get=20
it reported, and then it can be rolled into the distribution.</DIV>
<DIV> </DIV>
<DIV>Regards</DIV>
<DIV>Frank</DIV>
<DIV> </DIV>
<DIV>On Thu, 2018-04-19 at 21:19 +0300, Klaipedaville on Google =
wrote:</DIV>
<BLOCKQUOTE=20
style=3D"PADDING-LEFT: 1ex; MARGIN: 0px 0px 0px 0.8ex; BORDER-LEFT: =
#729fcf 2px solid"=20
type=3D"cite">
<DIV dir=3Dltr>
<DIV style=3D"FONT-SIZE: 12pt; FONT-FAMILY: 'Calibri'; COLOR: =
#000000">
<DIV>Hi Frank,</DIV>
<DIV> </DIV>
<DIV>Thank you for replying.</DIV>
<DIV> </DIV>
<DIV>Well, the "named module" that is the name script and service of =
Logwatch=20
do not really parse the Bind9=E2=80=99s log files as I=E2=80=99ve =
mentioned in my first=20
message before. Bind recommends custom logging because when you leave =
it=20
"dropping" right into your syslog it does not really reflect the real =
picture=20
so to speak. Now when you set it up as per Bind=E2=80=99s =
recommendations then there=20
is nothing reported by Logwatch because there is nothing "dumped" into =
your=20
syslog any more where Logwatch picks up "named module logging" from. =
That=E2=80=99s=20
why I was asking if there were any work arounds to make Logwatch =
report on=20
Bind9's?.. I thought that Bind=E2=80=99s script and service in =
Logwatch were=20
required.. was I wrong? Thanks.</DIV>
<DIV> </DIV>
<DIV>Regards,</DIV>
<DIV>Dennis</DIV>
<DIV> </DIV>
<DIV>P.S. I provided log examples in my first email to try to parse it =
/ feed=20
it through "named module"... it did not work my side...</DIV>
<DIV> </DIV>
<DIV> </DIV>
<DIV=20
style=3D"FONT-SIZE: small; FONT-FAMILY: 'Calibri'; FONT-WEIGHT: =
normal; COLOR: #000000; FONT-STYLE: normal; TEXT-DECORATION: none; =
DISPLAY: inline">
<DIV style=3D"FONT: 10pt tahoma">
<DIV><FONT size=3D3 face=3DCalibri></FONT> </DIV>
<DIV style=3D"BACKGROUND: #f5f5f5">
<DIV style=3D"font-color: black"><B>From:</B> <A =
[email protected]=20
href=3D"mailto:[email protected]">Frank Crawford</A> </DIV>
<DIV><B>Sent:</B> Thursday, April 19, 2018 15:05</DIV>
<DIV><B>To:</B> <A [email protected]=20
href=3D"mailto:[email protected]">Klaipedaville on Google</A> ; =
<A=20
title=3Dlogwatch-devel-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org=20
=
href=3D"mailto:[email protected]">logwatch-devel</A> =
; <A=20
[email protected] href=3D"mailto:[email protected]">Orion =
Poplawski</A> </DIV>
<DIV><B>Subject:</B> Re: [Logwatch-devel] Bind Service &=20
Script</DIV></DIV></DIV>
<DIV> </DIV></DIV>
<DIV=20
style=3D"FONT-SIZE: small; FONT-FAMILY: 'Calibri'; FONT-WEIGHT: =
normal; COLOR: #000000; FONT-STYLE: normal; TEXT-DECORATION: none; =
DISPLAY: inline">
<DIV>Dennis,</DIV>
<DIV> </DIV>
<DIV>Isn't the "named" module what you need? It does look through=20
/var/log/messages for the output, not a dedicated bind file, but still =
it is=20
what I see for my DNS server output.</DIV>
<DIV> </DIV>
<DIV>Frank</DIV>
<DIV> </DIV>
<DIV>On Wed, 2018-04-18 at 17:28 +0300, Klaipedaville on Google =
wrote:</DIV>
<BLOCKQUOTE=20
style=3D"PADDING-LEFT: 1ex; MARGIN: 0px 0px 0px 0.8ex; BORDER-LEFT: =
#729fcf 2px solid"=20
type=3D"cite">
<DIV dir=3Dltr>
<DIV style=3D"FONT-SIZE: 12pt; FONT-FAMILY: 'Calibri'; COLOR: =
#000000">
<DIV>Hello everybody, </DIV>
<DIV> </DIV>
<DIV>I can=E2=80=99t believe it that the latest Logwatch 7.4.3 still =
does not have=20
any Bind services and scripts. Am I wrong? I tried to "feed" =
bind9=E2=80=99s regular=20
log files to named but it won=E2=80=99t parse them. Could anybody =
advise, please on=20
how to make Logwatch "report" Bind? The standard / regular log files =
in=20
Bind9 are setup like this:</DIV>
<DIV> </DIV>
<DIV>logging {</DIV>
<DIV>channel bind_log {</DIV>
<DIV>file "/var/log/bind/bind.log" versions 3 size 5m;</DIV>
<DIV>severity info;</DIV>
<DIV>print-category yes;</DIV>
<DIV>print-severity yes;</DIV>
<DIV>print-time yes;</DIV>
<DIV> };</DIV>
<DIV>};</DIV>
<DIV> </DIV>
<DIV>and what the logging produces as the outcome looks like =
this:</DIV>
<DIV> </DIV>
<DIV>18-Apr-2018 11:36:14.961 queries: info: client 1.2.3.4#52132: =
query:=20
ns2.barcap.com IN A + (1.2.3.4)</DIV>
<DIV>18-Apr-2018 11:36:14.961 queries: info: client 1.2.3.4#52132: =
query:=20
a10-66.akam.net IN A + (1.2.3.4)</DIV>
<DIV>18-Apr-2018 11:36:14.962 queries: info: client 1.2.3.4#52132: =
query:=20
a9-66.akam.net IN A + (1.2.3.4)</DIV>
<DIV>18-Apr-2018 11:36:14.962 queries: info: client 1.2.3.4#132: =
query:=20
ns7.barcap.com IN A + (1.2.3.4)</DIV>
<DIV>18-Apr-2018 11:36:14.963 queries: info: client 1.2.3.4#52132: =
query:=20
ns3.barcap.com IN A + (1.2.3.4)</DIV>
<DIV>18-Apr-2018 11:36:14.963 queries: info: client 1.2.3.4#52132: =
query:=20
a1-71.akam.net IN A + (1.2.3.4)</DIV>
<DIV>18-Apr-2018 11:36:14.964 queries: info: client 1.12.3.4#52132: =
query:=20
a12-64.akam.net IN A + (1.2.3.4)</DIV>
<DIV> </DIV>
<DIV>I would be really grateful for any pointers, suggestions,=20
recommendations, assistance.</DIV>
<DIV> </DIV>
<DIV>Many thanks in advance!</DIV>
<DIV> </DIV>
<DIV>Regards,</DIV>
<DIV>Dennis</DIV>
<DIV>
<DIV=20
style=3D"FONT-SIZE: small; FONT-FAMILY: 'Calibri'; FONT-WEIGHT: =
normal; COLOR: #000000; FONT-STYLE: normal; TEXT-DECORATION: none; =
DISPLAY: =
inline"></DIV> </DIV></DIV></DIV><PRE>------------------------------=
------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! <A =
href=3D"http://sdm.link/slashdot">http://sdm.link/slashdot</A></PRE><PRE>=
_______________________________________________
Logwatch-devel mailing list
<A =
href=3D"mailto:[email protected]">Logwatch-devel@lists=
.sourceforge.net</A>
<A =
href=3D"https://lists.sourceforge.net/lists/listinfo/logwatch-devel">http=
s://lists.sourceforge.net/lists/listinfo/logwatch-devel</A>
</PRE></BLOCKQUOTE></DIV></DIV></DIV></BLOCKQUOTE></DIV></DIV></DIV></BOD=
Y></HTML>
------=_NextPart_000_004A_01D3D985.3A5B8330--
--===============7999700047746330126==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot
--===============7999700047746330126==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
_______________________________________________
Logwatch-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/logwatch-devel
--===============7999700047746330126==--