Re: Bind Service & Script
Frank Crawford <[email protected]> Sat, 03 Nov 2018 19:46:57 +1100
| Newsgroups | gmane.comp.log.logwatch.devel |
|---|---|
| Message-ID | <8a64ab69acb6d310da114b953f09bc44639f6ac0.camel@crawford.emu.id.au> |
--===============3060728686307203539==
Content-Type: multipart/alternative; boundary="=-jJqhExl5zOUQiqrwKNhF"
--=-jJqhExl5zOUQiqrwKNhF
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 8bit
Folks,
I've been meaning to update the list on the fix for this, just in case
anyone else has the same problem. The main fix was to create the file
/etc/logwatch/conf/services/named.conf with the following entries:
# Logfiles to reviewLogFile = /var/log/bind/bind.log
# Note this exact string depends on the settings of print-category,
print-severity and print-time.# The below setting assumes all three are
enabled.*RemoveHeaders = "^\d\d-\w{3}-\d\d\d\d \d\d:\d\d:\d\d\.\d\d\d
\w*: \w*: "
However, you also need to comment out the "*OnlyService" option in the
original configuration file (probably
/usr/share/logwatch/conf/services/named.conf) as I cannot see anyway to
suppress it in the local configuration file.
If anyone knows a way to do it, I'd like to hear it.
RegardsFrank
On Sat, 2018-04-21 at 15:27 +0300, Klaipedaville on Google wrote:
>
> Hi Frank,
>
>
>
> Thank you so much for your replying. I appreciate.
>
>
>
> Well, I would like it simply to report on errors, denied queries,
> security,
> unexpected RCODEs, and refused connections both ways because right
> now it does
> not report anything at all when I type the following for example:
>
>
>
> logwatch --detail high --service name --range all
>
>
>
> As you can see I ask it to advise me on all the entries there are
> out
> there, not only daily ones, but alas, there is nothing reported, no
> extension of
> its standard logging reported, no any other output reported at all. I
> have not
> deleted any of my log files at all yet but it still won’t pick them
> up. I also
> typed –range all, --range today, --range yesterday and so on and so
> forth which
> should have reported at least something but it does not happen. Thus,
> I assumed
> that the "name" script and service found in Logwatch could not really
> read and
> parse Bind9’s log files.
>
>
>
> I specified of course my custom log files in Logwatch, that is I set
> the
> path in my copy of named.conf to be like this in ../logfiles:
>
>
>
> LogFile = /var/log/bind/bind.log
>
>
>
> and I also defined it in my copy of named.conf in ../services to read
> my
> bind.log file like this:
>
>
>
> LogFile = bind
>
>
>
> I've also configured different scripts and services of Logwatch
> before and
> they have been running perfectly well, with the only exception that
> they were
> the "exact" ones so speak. For instance I customized dovecot for
> dovecot,
> proftpd for proftpd, spamassassin for spamassassin and so on but here
> we have to
> customize the named for bind9 which in my understanding might be
> totally
> different and may require this named script’s and service’s thorough
> re-writing
> (completely new script?). However, I am glad you are saying I am all
> wrong and I
> would be thankful if you could assist me.
>
>
>
> It would be also nice to take a look at your bind9’s logging example,
> the
> output it generates, and the output your named creates out of it when
> it's
> parsed.
>
>
>
> Many thanks in advance!
>
>
>
> Regards,
>
> Dennis
>
>
>
>
>
>
>
>
> From: Frank Crawford
>
> Sent: Saturday, April 21, 2018 09:04
>
> To: Klaipedaville on Google ; logwatch-devel ; Orion Poplawski
>
> Subject: Re: [Logwatch-devel] Bind Service &
> Script
>
>
>
>
> Dennis,
>
> Firstly, I would say that what you are logging there is an extension
> of the
> standard logging in bind. While you have defined a new channel, you
> haven't
> noted what categories are going there. The default_syslog channel
> doesn't
> include category, severity or time, hence the default logwatch module
> doesn't
> pick up those extra fields.
>
> Anyway, you have two different items of concern, you can easily
> configure
> logwatch to pickup the bind9 file by editing the appropriate service
> configuration file.
>
> Now, what is the appropriate service gets a bit more tricky. Firstly,
> what
> do you expect it to report on that particular output? It looks more
> like what
> you would dump doing debugging of queries, especially since you have
> a 5Mb limit
> on the size, with 3 copies, so it would rotate pretty quickly, and
> logwatch
> really is normally run on daily logs, not transient logs.
>
> Once you work out what you want to report, I'd argue that you still
> want to
> use the named script, it already understands bind9 output (I run it
> across my
> nameservers and it reports the operational issues fine). You would
> probably want
> to add additional pattern matches because, as you say, it doesn't
> currently
> match those lines. I can guess some stats you may want, but that may
> be
> different to your requirements.
>
> If you can work out what you want I can suggest what you need to do
> to get
> it reported, and then it can be rolled into the distribution.
>
> Regards
> Frank
>
> On Thu, 2018-04-19 at 21:19 +0300, Klaipedaville on Google wrote:
> >
> >
> > Hi Frank,
> >
> >
> >
> > Thank you for replying.
> >
> >
> >
> > Well, the "named module" that is the name script and service of
> > Logwatch
> > do not really parse the Bind9’s log files as I’ve mentioned in my
> > first
> > message before. Bind recommends custom logging because when you
> > leave it
> > "dropping" right into your syslog it does not really reflect the
> > real picture
> > so to speak. Now when you set it up as per Bind’s recommendations
> > then there
> > is nothing reported by Logwatch because there is nothing "dumped"
> > into your
> > syslog any more where Logwatch picks up "named module logging"
> > from. That’s
> > why I was asking if there were any work arounds to make Logwatch
> > report on
> > Bind9's?.. I thought that Bind’s script and service in Logwatch
> > were
> > required.. was I wrong? Thanks.
> >
> >
> >
> > Regards,
> >
> > Dennis
> >
> >
> >
> > P.S. I provided log examples in my first email to try to parse it
> > / feed
> > it through "named module"... it did not work my side...
> >
> >
> >
> >
> >
> >
> >
> >
> >
> >
> > From: Frank Crawford
> >
> > Sent: Thursday, April 19, 2018 15:05
> >
> > To: Klaipedaville on Google ; logwatch-devel ; Orion Poplawski
> >
> > Subject: Re: [Logwatch-devel] Bind Service &
> > Script
> >
> >
> >
> >
> > Dennis,
> >
> > Isn't the "named" module what you need? It does look through
> > /var/log/messages for the output, not a dedicated bind file, but
> > still it is
> > what I see for my DNS server output.
> >
> > Frank
> >
> > On Wed, 2018-04-18 at 17:28 +0300, Klaipedaville on Google wrote:
> >
> > >
> > >
> > > Hello everybody,
> > >
> > >
> > >
> > > I can’t believe it that the latest Logwatch 7.4.3 still does
> > > not have
> > > any Bind services and scripts. Am I wrong? I tried to "feed"
> > > bind9’s regular
> > > log files to named but it won’t parse them. Could anybody
> > > advise, please on
> > > how to make Logwatch "report" Bind? The standard / regular
> > > log files in
> > > Bind9 are setup like this:
> > >
> > >
> > >
> > > logging {
> > >
> > > channel bind_log {
> > >
> > > file "/var/log/bind/bind.log" versions 3 size 5m;
> > >
> > > severity info;
> > >
> > > print-category yes;
> > >
> > > print-severity yes;
> > >
> > > print-time yes;
> > >
> > > };
> > >
> > > };
> > >
> > >
> > >
> > > and what the logging produces as the outcome looks like this:
> > >
> > >
> > >
> > > 18-Apr-2018 11:36:14.961 queries: info: client 1.2.3.4#52132:
> > > query:
> > > ns2.barcap.com IN A + (1.2.3.4)
> > >
> > > 18-Apr-2018 11:36:14.961 queries: info: client 1.2.3.4#52132:
> > > query:
> > > a10-66.akam.net IN A + (1.2.3.4)
> > >
> > > 18-Apr-2018 11:36:14.962 queries: info: client 1.2.3.4#52132:
> > > query:
> > > a9-66.akam.net IN A + (1.2.3.4)
> > >
> > > 18-Apr-2018 11:36:14.962 queries: info: client 1.2.3.4#132:
> > > query:
> > > ns7.barcap.com IN A + (1.2.3.4)
> > >
> > > 18-Apr-2018 11:36:14.963 queries: info: client 1.2.3.4#52132:
> > > query:
> > > ns3.barcap.com IN A + (1.2.3.4)
> > >
> > > 18-Apr-2018 11:36:14.963 queries: info: client 1.2.3.4#52132:
> > > query:
> > > a1-71.akam.net IN A + (1.2.3.4)
> > >
> > > 18-Apr-2018 11:36:14.964 queries: info: client
> > > 1.12.3.4#52132: query:
> > > a12-64.akam.net IN A + (1.2.3.4)
> > >
> > >
> > >
> > > I would be really grateful for any pointers, suggestions,
> > > recommendations, assistance.
> > >
> > >
> > >
> > > Many thanks in advance!
> > >
> > >
> > >
> > > Regards,
> > >
> > > Dennis
> > >
> > >
> > >
> > > ---------------------------------------------------------------
> > > ---------------Check out the vibrant tech community on one of the
> > > world's mostengaging tech sites, Slashdot.org!
> > > http://sdm.link/slashdot_______________________________________________Logwatch-devel
> > > mailing listLogwatch-devel-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org
> > > https://lists.sourceforge.net/lists/listinfo/logwatch-devel
--=-jJqhExl5zOUQiqrwKNhF
Content-Type: text/html; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
<html dir=3D"ltr"><head></head>
<body dir=3D"ltr" style=3D"text-align:left; direction:ltr;"><div>Folks,</di=
v><div><br></div><div>I've been meaning to update the list on the fix for t=
his, just in case anyone else has the same problem. The main fix was to cr=
eate the file /etc/logwatch/conf/services/named.conf with the following ent=
ries:</div><div><br></div><div># Logfiles to review</div><div>LogFile =3D /=
var/log/bind/bind.log</div><div><br></div><div># Note this exact string dep=
ends on the settings of print-category, print-severity and print-time.</div=
><div># The below setting assumes all three are enabled.</div><div>*RemoveH=
eaders =3D "^\d\d-\w{3}-\d\d\d\d \d\d:\d\d:\d\d\.\d\d\d \w*: \w*: "</div><d=
iv><br></div><div><br></div><div>However, you also need to comment out the =
"*OnlyService" option in the original configuration file (probably /usr/sha=
re/logwatch/conf/services/named.conf) as I cannot see anyway to suppress it=
in the local configuration file.</div><div><br></div><div>If anyone knows =
a way to do it, I'd like to hear it.</div><div><br></div><div>Regards</div>=
<div>Frank</div><div><br></div><div>On Sat, 2018-04-21 at 15:27 +0300, Klai=
pedaville on Google wrote:</div><blockquote type=3D"cite" style=3D"margin:0=
0 0 .8ex; border-left:2px #729fcf solid;padding-left:1ex">
<div dir=3D"ltr">
<div style=3D"FONT-SIZE: 12pt; FONT-FAMILY: 'Calibri'; COLOR: #000000">
<div>Hi Frank,</div>
<div> </div>
<div>Thank you so much for your replying. I appreciate.</div>
<div> </div>
<div>Well, I would like it simply to report on errors, denied queries, secu=
rity,=20
unexpected RCODEs, and refused connections both ways because right now it d=
oes=20
not report anything at all when I type the following for example:</div>
<div> </div>
<div>logwatch --detail high --service name --range all</div>
<div> </div>
<div>As you can see I ask it to advise me on all the entries there are out=
=20
there, not only daily ones, but alas, there is nothing reported, no extensi=
on of=20
its standard logging reported, no any other output reported at all. I have =
not=20
deleted any of my log files at all yet but it still won=E2=80=99t pick them=
up. I also=20
typed =E2=80=93range all, --range today, --range yesterday and so on and so=
forth which=20
should have reported at least something but it does not happen. Thus, I ass=
umed=20
that the "name" script and service found in Logwatch could not really read =
and=20
parse Bind9=E2=80=99s log files. </div>
<div> </div>
<div>I specified of course my custom log files in Logwatch, that is I set t=
he=20
path in my copy of named.conf to be like this in ../logfiles:</div>
<div> </div>
<div>LogFile =3D /var/log/bind/bind.log</div>
<div> </div>
<div>and I also defined it in my copy of named.conf in ../services to read =
my=20
bind.log file like this:</div>
<div> </div>
<div>LogFile =3D bind</div>
<div> </div>
<div>I've also configured different scripts and services of Logwatch before=
and=20
they have been running perfectly well, with the only exception that they we=
re=20
the "exact" ones so speak. For instance I customized dovecot for dovecot,=
=20
proftpd for proftpd, spamassassin for spamassassin and so on but here we ha=
ve to=20
customize the named for bind9 which in my understanding might be totally=
=20
different and may require this named script=E2=80=99s and service=E2=80=99s=
thorough re-writing=20
(completely new script?). However, I am glad you are saying I am all wrong =
and I=20
would be thankful if you could assist me.</div>
<div> </div>
<div>It would be also nice to take a look at your bind9=E2=80=99s logging e=
xample, the=20
output it generates, and the output your named creates out of it when it's=
=20
parsed.</div>
<div> </div>
<div>Many thanks in advance!</div>
<div> </div>
<div>Regards,</div>
<div>Dennis</div>
<div> </div>
<div>
<div style=3D"FONT-SIZE: small; FONT-FAMILY: 'Calibri'; FONT-WEIGHT: normal=
; COLOR: #000000; FONT-STYLE: normal; TEXT-DECORATION: none; DISPLAY: inlin=
e"><font size=3D"3" face=3D"Calibri"></font></div>
<div style=3D"FONT: 10pt tahoma">
<div style=3D"BACKGROUND: #f5f5f5">
<div style=3D"font-color: black"><b>From:</b> <a title=3D"[email protected]=
u.id.au" href=3D"mailto:[email protected]">Frank Crawford</a> </div>
<div><b>Sent:</b> Saturday, April 21, 2018 09:04</div>
<div><b>To:</b> <a title=3D"[email protected]" href=3D"mailto:klaiped=
[email protected]">Klaipedaville on Google</a> ; <a title=3D"logwatch-devel@=
lists.sourceforge.net" href=3D"mailto:[email protected]"=
>logwatch-devel</a> ; <a title=3D"[email protected]" href=3D"mailto:orion@nwra=
.com">Orion Poplawski</a> </div>
<div><b>Subject:</b> Re: [Logwatch-devel] Bind Service &=20
Script</div></div></div>
<div> </div></div>
<div style=3D"FONT-SIZE: small; FONT-FAMILY: 'Calibri'; FONT-WEIGHT: normal=
; COLOR: #000000; FONT-STYLE: normal; TEXT-DECORATION: none; DISPLAY: inlin=
e">
<div>Dennis,</div>
<div> </div>
<div>Firstly, I would say that what you are logging there is an extension o=
f the=20
standard logging in bind. While you have defined a new channel, you haven't=
=20
noted what categories are going there. The default_syslog channel doesn't=
=20
include category, severity or time, hence the default logwatch module doesn=
't=20
pick up those extra fields.</div>
<div> </div>
<div>Anyway, you have two different items of concern, you can easily config=
ure=20
logwatch to pickup the bind9 file by editing the appropriate service=20
configuration file.</div>
<div> </div>
<div>Now, what is the appropriate service gets a bit more tricky. Firstly, =
what=20
do you expect it to report on that particular output? It looks more like wh=
at=20
you would dump doing debugging of queries, especially since you have a 5Mb =
limit=20
on the size, with 3 copies, so it would rotate pretty quickly, and logwatch=
=20
really is normally run on daily logs, not transient logs.</div>
<div> </div>
<div>Once you work out what you want to report, I'd argue that you still wa=
nt to=20
use the named script, it already understands bind9 output (I run it across =
my=20
nameservers and it reports the operational issues fine). You would probably=
want=20
to add additional pattern matches because, as you say, it doesn't currently=
=20
match those lines. I can guess some stats you may want, but that may be=20
different to your requirements.</div>
<div> </div>
<div>If you can work out what you want I can suggest what you need to do to=
get=20
it reported, and then it can be rolled into the distribution.</div>
<div> </div>
<div>Regards</div>
<div>Frank</div>
<div> </div>
<div>On Thu, 2018-04-19 at 21:19 +0300, Klaipedaville on Google wrote:</div=
>
<blockquote type=3D"cite" style=3D"margin:0 0 0 .8ex; border-left:2px #729f=
cf solid;padding-left:1ex">
<div dir=3D"ltr">
<div style=3D"FONT-SIZE: 12pt; FONT-FAMILY: 'Calibri'; COLOR: #000000">
<div>Hi Frank,</div>
<div> </div>
<div>Thank you for replying.</div>
<div> </div>
<div>Well, the "named module" that is the name script and service of Logw=
atch=20
do not really parse the Bind9=E2=80=99s log files as I=E2=80=99ve mention=
ed in my first=20
message before. Bind recommends custom logging because when you leave it=
=20
"dropping" right into your syslog it does not really reflect the real pic=
ture=20
so to speak. Now when you set it up as per Bind=E2=80=99s recommendations=
then there=20
is nothing reported by Logwatch because there is nothing "dumped" into yo=
ur=20
syslog any more where Logwatch picks up "named module logging" from. That=
=E2=80=99s=20
why I was asking if there were any work arounds to make Logwatch report o=
n=20
Bind9's?.. I thought that Bind=E2=80=99s script and service in Logwatch w=
ere=20
required.. was I wrong? Thanks.</div>
<div> </div>
<div>Regards,</div>
<div>Dennis</div>
<div> </div>
<div>P.S. I provided log examples in my first email to try to parse it / =
feed=20
it through "named module"... it did not work my side...</div>
<div> </div>
<div> </div>
<div style=3D"FONT-SIZE: small; FONT-FAMILY: 'Calibri'; FONT-WEIGHT: norm=
al; COLOR: #000000; FONT-STYLE: normal; TEXT-DECORATION: none; DISPLAY: inl=
ine">
<div style=3D"FONT: 10pt tahoma">
<div><font size=3D"3" face=3D"Calibri"></font> </div>
<div style=3D"BACKGROUND: #f5f5f5">
<div style=3D"font-color: black"><b>From:</b> <a title=3D"frank@crawford.=
emu.id.au" href=3D"mailto:[email protected]">Frank Crawford</a> </di=
v>
<div><b>Sent:</b> Thursday, April 19, 2018 15:05</div>
<div><b>To:</b> <a title=3D"[email protected]" href=3D"mailto:klaip=
[email protected]">Klaipedaville on Google</a> ; <a title=3D"logwatch-deve=
[email protected]" href=3D"mailto:[email protected]=
t">logwatch-devel</a> ; <a title=3D"[email protected]" href=3D"mailto:orion@nw=
ra.com">Orion Poplawski</a> </div>
<div><b>Subject:</b> Re: [Logwatch-devel] Bind Service &=20
Script</div></div></div>
<div> </div></div>
<div style=3D"FONT-SIZE: small; FONT-FAMILY: 'Calibri'; FONT-WEIGHT: norm=
al; COLOR: #000000; FONT-STYLE: normal; TEXT-DECORATION: none; DISPLAY: inl=
ine">
<div>Dennis,</div>
<div> </div>
<div>Isn't the "named" module what you need? It does look through=20
/var/log/messages for the output, not a dedicated bind file, but still it=
is=20
what I see for my DNS server output.</div>
<div> </div>
<div>Frank</div>
<div> </div>
<div>On Wed, 2018-04-18 at 17:28 +0300, Klaipedaville on Google wrote:</d=
iv>
<blockquote type=3D"cite" style=3D"margin:0 0 0 .8ex; border-left:2px #72=
9fcf solid;padding-left:1ex">
<div dir=3D"ltr">
<div style=3D"FONT-SIZE: 12pt; FONT-FAMILY: 'Calibri'; COLOR: #000000">
<div>Hello everybody, </div>
<div> </div>
<div>I can=E2=80=99t believe it that the latest Logwatch 7.4.3 still do=
es not have=20
any Bind services and scripts. Am I wrong? I tried to "feed" bind9=E2=
=80=99s regular=20
log files to named but it won=E2=80=99t parse them. Could anybody advis=
e, please on=20
how to make Logwatch "report" Bind? The standard / regular log files in=
=20
Bind9 are setup like this:</div>
<div> </div>
<div>logging {</div>
<div>channel bind_log {</div>
<div>file "/var/log/bind/bind.log" versions 3 size 5m;</div>
<div>severity info;</div>
<div>print-category yes;</div>
<div>print-severity yes;</div>
<div>print-time yes;</div>
<div> };</div>
<div>};</div>
<div> </div>
<div>and what the logging produces as the outcome looks like this:</div=
>
<div> </div>
<div>18-Apr-2018 11:36:14.961 queries: info: client 1.2.3.4#52132: quer=
y:=20
ns2.barcap.com IN A + (1.2.3.4)</div>
<div>18-Apr-2018 11:36:14.961 queries: info: client 1.2.3.4#52132: quer=
y:=20
a10-66.akam.net IN A + (1.2.3.4)</div>
<div>18-Apr-2018 11:36:14.962 queries: info: client 1.2.3.4#52132: quer=
y:=20
a9-66.akam.net IN A + (1.2.3.4)</div>
<div>18-Apr-2018 11:36:14.962 queries: info: client 1.2.3.4#132: query:=
=20
ns7.barcap.com IN A + (1.2.3.4)</div>
<div>18-Apr-2018 11:36:14.963 queries: info: client 1.2.3.4#52132: quer=
y:=20
ns3.barcap.com IN A + (1.2.3.4)</div>
<div>18-Apr-2018 11:36:14.963 queries: info: client 1.2.3.4#52132: quer=
y:=20
a1-71.akam.net IN A + (1.2.3.4)</div>
<div>18-Apr-2018 11:36:14.964 queries: info: client 1.12.3.4#52132: que=
ry:=20
a12-64.akam.net IN A + (1.2.3.4)</div>
<div> </div>
<div>I would be really grateful for any pointers, suggestions,=20
recommendations, assistance.</div>
<div> </div>
<div>Many thanks in advance!</div>
<div> </div>
<div>Regards,</div>
<div>Dennis</div>
<div>
<div style=3D"FONT-SIZE: small; FONT-FAMILY: 'Calibri'; FONT-WEIGHT: no=
rmal; COLOR: #000000; FONT-STYLE: normal; TEXT-DECORATION: none; DISPLAY: i=
nline"></div> </div></div></div><pre>---------------------------------=
---------------------------------------------</pre><pre>Check out the vibra=
nt tech community on one of the world's most</pre><pre>engaging tech sites,=
Slashdot.org! <a href=3D"http://sdm.link/slashdot">http://sdm.link/slashdo=
t</a></pre><pre>_______________________________________________</pre><pre>L=
ogwatch-devel mailing list</pre><pre><a href=3D"mailto:Logwatch-devel@lists=
.sourceforge.net">[email protected]</a></pre><pre><a hre=
f=3D"https://lists.sourceforge.net/lists/listinfo/logwatch-devel">https://l=
ists.sourceforge.net/lists/listinfo/logwatch-devel</a></pre><pre><br></pre>=
</blockquote></div></div></div></blockquote></div></div></div>
</blockquote></body></html>
--=-jJqhExl5zOUQiqrwKNhF--
--===============3060728686307203539==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
--===============3060728686307203539==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
_______________________________________________
Logwatch-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/logwatch-devel
--===============3060728686307203539==--