Re: Bind Service & Script
Frank Crawford <[email protected]> Sat, 03 Nov 2018 23:24:18 +1100
| Newsgroups | gmane.comp.log.logwatch.devel |
|---|---|
| Message-ID | <00423176b7993e5e561a8450c134d473063f7a49.camel@crawford.emu.id.au> |
--===============6750771469417893355==
Content-Type: multipart/alternative; boundary="=-yp7Q+LbmoxNfM2ucp/rL"
--=-yp7Q+LbmoxNfM2ucp/rL
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 8bit
Dennis,
I mainly logged that so others can get started with just straight bind
output files, and not just parsing the output sent through syslog, as
there is nothing fundamentally different between the two, except how
logwatch preprocesses some of it.
There are a few other patches to named which I have just put up for
inclusion, which may or may not fix some of your other errors. I know
they cleaned up my output.
RegardsFrank
On Sat, 2018-11-03 at 13:58 +0200, Klaipedaville on Google wrote:
>
> Hi Frank,
>
>
>
> I see you’re still on it. Well, honestly speaking I gave up after I
> had
> spent 3 days trying to troubleshoot it. Instead, I wrote a very
> simple bash
> script on my own as I found it to be much easier, faster, and
> simpler. Although
> I have bind also running through Logwatch and it’s suits me perfectly
> fine in
> combination of these two.
>
>
>
> I still believe that the existing bind's (named) service and script
> require
> an update / re-writing / re-coding, the problem here is not in
> configuration.
> But that's just my opinion of course.
>
>
>
> Regards,
>
> Dennis
>
>
>
>
>
>
>
>
> From: Frank Crawford
>
> Sent: Saturday, November 3, 2018 10:46
>
> To: logwatch-devel
>
> Subject: Re: [Logwatch-devel] Bind Service &
> Script
>
>
>
>
> Folks,
>
> I've been meaning to update the list on the fix for this, just in
> case
> anyone else has the same problem. The main fix was to create the
> file
> /etc/logwatch/conf/services/named.conf with the following entries:
>
> # Logfiles to review
> LogFile = /var/log/bind/bind.log
>
> # Note this exact string depends on the settings of print-category,
> print-severity and print-time.
> # The below setting assumes all three are enabled.
> *RemoveHeaders = "^\d\d-\w{3}-\d\d\d\d \d\d:\d\d:\d\d\.\d\d\d \w*:
> \w*:
> "
>
>
> However, you also need to comment out the "*OnlyService" option in
> the
> original configuration file (probably
> /usr/share/logwatch/conf/services/named.conf) as I cannot see anyway
> to suppress
> it in the local configuration file.
>
> If anyone knows a way to do it, I'd like to hear it.
>
> Regards
> Frank
>
> On Sat, 2018-04-21 at 15:27 +0300, Klaipedaville on Google wrote:
> >
> >
> > Hi Frank,
> >
> >
> >
> > Thank you so much for your replying. I appreciate.
> >
> >
> >
> > Well, I would like it simply to report on errors, denied
> > queries,
> > security, unexpected RCODEs, and refused connections both ways
> > because right
> > now it does not report anything at all when I type the following
> > for
> > example:
> >
> >
> >
> > logwatch --detail high --service name --range all
> >
> >
> >
> > As you can see I ask it to advise me on all the entries there are
> > out
> > there, not only daily ones, but alas, there is nothing reported,
> > no extension
> > of its standard logging reported, no any other output reported at
> > all. I have
> > not deleted any of my log files at all yet but it still won’t
> > pick them up. I
> > also typed –range all, --range today, --range yesterday and so on
> > and so forth
> > which should have reported at least something but it does not
> > happen. Thus, I
> > assumed that the "name" script and service found in Logwatch
> > could not really
> > read and parse Bind9’s log files.
> >
> >
> >
> > I specified of course my custom log files in Logwatch, that is I
> > set the
> > path in my copy of named.conf to be like this in ../logfiles:
> >
> >
> >
> > LogFile = /var/log/bind/bind.log
> >
> >
> >
> > and I also defined it in my copy of named.conf in ../services to
> > read my
> > bind.log file like this:
> >
> >
> >
> > LogFile = bind
> >
> >
> >
> > I've also configured different scripts and services of Logwatch
> > before
> > and they have been running perfectly well, with the only
> > exception that they
> > were the "exact" ones so speak. For instance I customized dovecot
> > for dovecot,
> > proftpd for proftpd, spamassassin for spamassassin and so on but
> > here we have
> > to customize the named for bind9 which in my understanding might
> > be totally
> > different and may require this named script’s and service’s
> > thorough
> > re-writing (completely new script?). However, I am glad you are
> > saying I am
> > all wrong and I would be thankful if you could assist me.
> >
> >
> >
> > It would be also nice to take a look at your bind9’s logging
> > example, the
> > output it generates, and the output your named creates out of it
> > when it's
> > parsed.
> >
> >
> >
> > Many thanks in advance!
> >
> >
> >
> > Regards,
> >
> > Dennis
> >
> >
> >
> >
> >
> >
> >
> >
> > From: Frank Crawford
> >
> > Sent: Saturday, April 21, 2018 09:04
> >
> > To: Klaipedaville on Google ; logwatch-devel ; Orion Poplawski
> >
> > Subject: Re: [Logwatch-devel] Bind Service &
> > Script
> >
> >
> >
> >
> > Dennis,
> >
> > Firstly, I would say that what you are logging there is an
> > extension of
> > the standard logging in bind. While you have defined a new
> > channel, you
> > haven't noted what categories are going there. The default_syslog
> > channel
> > doesn't include category, severity or time, hence the default
> > logwatch module
> > doesn't pick up those extra fields.
> >
> > Anyway, you have two different items of concern, you can easily
> > configure
> > logwatch to pickup the bind9 file by editing the appropriate
> > service
> > configuration file.
> >
> > Now, what is the appropriate service gets a bit more tricky.
> > Firstly,
> > what do you expect it to report on that particular output? It
> > looks more like
> > what you would dump doing debugging of queries, especially since
> > you have a
> > 5Mb limit on the size, with 3 copies, so it would rotate pretty
> > quickly, and
> > logwatch really is normally run on daily logs, not transient
> > logs.
> >
> > Once you work out what you want to report, I'd argue that you
> > still want
> > to use the named script, it already understands bind9 output (I
> > run it across
> > my nameservers and it reports the operational issues fine). You
> > would probably
> > want to add additional pattern matches because, as you say, it
> > doesn't
> > currently match those lines. I can guess some stats you may want,
> > but that may
> > be different to your requirements.
> >
> > If you can work out what you want I can suggest what you need to
> > do to
> > get it reported, and then it can be rolled into the distribution.
> >
> > Regards
> > Frank
> >
> > On Thu, 2018-04-19 at 21:19 +0300, Klaipedaville on Google wrote:
> >
> > >
> > >
> > > Hi Frank,
> > >
> > >
> > >
> > > Thank you for replying.
> > >
> > >
> > >
> > > Well, the "named module" that is the name script and service
> > > of
> > > Logwatch do not really parse the Bind9’s log files as I’ve
> > > mentioned in my
> > > first message before. Bind recommends custom logging because
> > > when you leave
> > > it "dropping" right into your syslog it does not really
> > > reflect the real
> > > picture so to speak. Now when you set it up as per Bind’s
> > > recommendations
> > > then there is nothing reported by Logwatch because there is
> > > nothing "dumped"
> > > into your syslog any more where Logwatch picks up "named
> > > module logging"
> > > from. That’s why I was asking if there were any work arounds
> > > to make
> > > Logwatch report on Bind9's?.. I thought that Bind’s script
> > > and service in
> > > Logwatch were required.. was I wrong? Thanks.
> > >
> > >
> > >
> > > Regards,
> > >
> > > Dennis
> > >
> > >
> > >
> > > P.S. I provided log examples in my first email to try to
> > > parse it /
> > > feed it through "named module"... it did not work my side...
> > >
> > >
> > >
> > >
> > >
> > >
> > >
> > >
> > >
> > >
> > > From: Frank
> > > Crawford
> > >
> > > Sent: Thursday, April 19, 2018 15:05
> > >
> > > To: Klaipedaville on Google ; logwatch-devel ; Orion
> > > Poplawski
> > >
> > > Subject: Re: [Logwatch-devel] Bind Service &
> > > Script
> > >
> > >
> > >
> > >
> > > Dennis,
> > >
> > > Isn't the "named" module what you need? It does look through
> > > /var/log/messages for the output, not a dedicated bind file,
> > > but still it is
> > > what I see for my DNS server output.
> > >
> > > Frank
> > >
> > > On Wed, 2018-04-18 at 17:28 +0300, Klaipedaville on Google
> > > wrote:
> > >
> > > >
> > > >
> > > > Hello everybody,
> > > >
> > > >
> > > >
> > > > I can’t believe it that the latest Logwatch 7.4.3 still
> > > > does not have
> > > > any Bind services and scripts. Am I wrong? I tried to
> > > > "feed" bind9’s
> > > > regular log files to named but it won’t parse them. Could
> > > > anybody advise,
> > > > please on how to make Logwatch "report" Bind? The
> > > > standard / regular log
> > > > files in Bind9 are setup like this:
> > > >
> > > >
> > > >
> > > > logging {
> > > >
> > > > channel bind_log {
> > > >
> > > > file "/var/log/bind/bind.log" versions 3 size 5m;
> > > >
> > > > severity info;
> > > >
> > > > print-category yes;
> > > >
> > > > print-severity yes;
> > > >
> > > > print-time yes;
> > > >
> > > > };
> > > >
> > > > };
> > > >
> > > >
> > > >
> > > > and what the logging produces as the outcome looks like
> > > > this:
> > > >
> > > >
> > > >
> > > > 18-Apr-2018 11:36:14.961 queries: info: client
> > > > 1.2.3.4#52132: query:
> > > > ns2.barcap.com IN A + (1.2.3.4)
> > > >
> > > > 18-Apr-2018 11:36:14.961 queries: info: client
> > > > 1.2.3.4#52132: query:
> > > > a10-66.akam.net IN A + (1.2.3.4)
> > > >
> > > > 18-Apr-2018 11:36:14.962 queries: info: client
> > > > 1.2.3.4#52132: query:
> > > > a9-66.akam.net IN A + (1.2.3.4)
> > > >
> > > > 18-Apr-2018 11:36:14.962 queries: info: client
> > > > 1.2.3.4#132: query:
> > > > ns7.barcap.com IN A + (1.2.3.4)
> > > >
> > > > 18-Apr-2018 11:36:14.963 queries: info: client
> > > > 1.2.3.4#52132: query:
> > > > ns3.barcap.com IN A + (1.2.3.4)
> > > >
> > > > 18-Apr-2018 11:36:14.963 queries: info: client
> > > > 1.2.3.4#52132: query:
> > > > a1-71.akam.net IN A + (1.2.3.4)
> > > >
> > > > 18-Apr-2018 11:36:14.964 queries: info: client
> > > > 1.12.3.4#52132: query:
> > > > a12-64.akam.net IN A + (1.2.3.4)
> > > >
> > > >
> > > >
> > > > I would be really grateful for any pointers,
> > > > suggestions,
> > > > recommendations, assistance.
> > > >
> > > >
> > > >
> > > > Many thanks in advance!
> > > >
> > > >
> > > >
> > > > Regards,
> > > >
> > > > Dennis
> > > >
> > > >
> > > >
> > > > -------------------------------------------------------------
> > > > -----------------Check out the vibrant tech community on one of
> > > > the world's mostengaging tech sites, Slashdot.org!
> > > > http://sdm.link/slashdot_______________________________________________Logwatch-devel
> > > > mailing listLogwatch-devel-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org
> > > > https://lists.sourceforge.net/lists/listinfo/logwatch-devel
>
>
>
>
>
> _______________________________________________
> Logwatch-devel mailing
> list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/logwatch-devel
>
--=-yp7Q+LbmoxNfM2ucp/rL
Content-Type: text/html; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
<html dir=3D"ltr"><head></head>
<body dir=3D"ltr" style=3D"text-align:left; direction:ltr;"><div>Dennis,</d=
iv><div><br></div><div>I mainly logged that so others can get started with =
just straight bind output files, and not just parsing the output sent throu=
gh syslog, as there is nothing fundamentally different between the two, exc=
ept how logwatch preprocesses some of it.</div><div><br></div><div>There ar=
e a few other patches to named which I have just put up for inclusion, whic=
h may or may not fix some of your other errors. I know they cleaned up my o=
utput.</div><div><br></div><div>Regards</div><div>Frank </div><div><br></di=
v><div>On Sat, 2018-11-03 at 13:58 +0200, Klaipedaville on Google wrote:</d=
iv><blockquote type=3D"cite" style=3D"margin:0 0 0 .8ex; border-left:2px #7=
29fcf solid;padding-left:1ex">
<div dir=3D"ltr">
<div style=3D"FONT-SIZE: 12pt; FONT-FAMILY: 'Calibri'; COLOR: #000000">
<div>Hi Frank,</div>
<div> </div>
<div>I see you=E2=80=99re still on it. Well, honestly speaking I gave up af=
ter I had=20
spent 3 days trying to troubleshoot it. Instead, I wrote a very simple bash=
=20
script on my own as I found it to be much easier, faster, and simpler. Alth=
ough=20
I have bind also running through Logwatch and it=E2=80=99s suits me perfect=
ly fine in=20
combination of these two.</div>
<div> </div>
<div>I still believe that the existing bind's (named) service and script re=
quire=20
an update / re-writing / re-coding, the problem here is not in configuratio=
n.=20
But that's just my opinion of course.</div>
<div> </div>
<div>Regards,</div>
<div>Dennis</div>
<div> </div>
<div style=3D"FONT-SIZE: small; FONT-FAMILY: 'Calibri'; FONT-WEIGHT: normal=
; COLOR: #000000; FONT-STYLE: normal; TEXT-DECORATION: none; DISPLAY: inlin=
e">
<div style=3D"FONT: 10pt tahoma">
<div> </div>
<div style=3D"BACKGROUND: #f5f5f5">
<div style=3D"font-color: black"><b>From:</b> <a title=3D"[email protected]=
u.id.au" href=3D"mailto:[email protected]">Frank Crawford</a> </div>
<div><b>Sent:</b> Saturday, November 3, 2018 10:46</div>
<div><b>To:</b> <a title=3D"[email protected]" href=3D"m=
ailto:[email protected]">logwatch-devel</a> </div>
<div><b>Subject:</b> Re: [Logwatch-devel] Bind Service &=20
Script</div></div></div>
<div> </div></div>
<div style=3D"FONT-SIZE: small; FONT-FAMILY: 'Calibri'; FONT-WEIGHT: normal=
; COLOR: #000000; FONT-STYLE: normal; TEXT-DECORATION: none; DISPLAY: inlin=
e">
<div>Folks,</div>
<div> </div>
<div>I've been meaning to update the list on the fix for this, just in case=
=20
anyone else has the same problem. The main fix was to create the file=20
/etc/logwatch/conf/services/named.conf with the following entries:</div>
<div> </div>
<div># Logfiles to review</div>
<div>LogFile =3D /var/log/bind/bind.log</div>
<div> </div>
<div># Note this exact string depends on the settings of print-category,=
=20
print-severity and print-time.</div>
<div># The below setting assumes all three are enabled.</div>
<div>*RemoveHeaders =3D "^\d\d-\w{3}-\d\d\d\d \d\d:\d\d:\d\d\.\d\d\d \w*: \=
w*:=20
"</div>
<div> </div>
<div> </div>
<div>However, you also need to comment out the "*OnlyService" option in the=
=20
original configuration file (probably=20
/usr/share/logwatch/conf/services/named.conf) as I cannot see anyway to sup=
press=20
it in the local configuration file.</div>
<div> </div>
<div>If anyone knows a way to do it, I'd like to hear it.</div>
<div> </div>
<div>Regards</div>
<div>Frank</div>
<div> </div>
<div>On Sat, 2018-04-21 at 15:27 +0300, Klaipedaville on Google wrote:</div=
>
<blockquote type=3D"cite" style=3D"margin:0 0 0 .8ex; border-left:2px #729f=
cf solid;padding-left:1ex">
<div dir=3D"ltr">
<div style=3D"FONT-SIZE: 12pt; FONT-FAMILY: 'Calibri'; COLOR: #000000">
<div>Hi Frank,</div>
<div> </div>
<div>Thank you so much for your replying. I appreciate.</div>
<div> </div>
<div>Well, I would like it simply to report on errors, denied queries,=
=20
security, unexpected RCODEs, and refused connections both ways because ri=
ght=20
now it does not report anything at all when I type the following for=20
example:</div>
<div> </div>
<div>logwatch --detail high --service name --range all</div>
<div> </div>
<div>As you can see I ask it to advise me on all the entries there are ou=
t=20
there, not only daily ones, but alas, there is nothing reported, no exten=
sion=20
of its standard logging reported, no any other output reported at all. I =
have=20
not deleted any of my log files at all yet but it still won=E2=80=99t pic=
k them up. I=20
also typed =E2=80=93range all, --range today, --range yesterday and so on=
and so forth=20
which should have reported at least something but it does not happen. Thu=
s, I=20
assumed that the "name" script and service found in Logwatch could not re=
ally=20
read and parse Bind9=E2=80=99s log files. </div>
<div> </div>
<div>I specified of course my custom log files in Logwatch, that is I set=
the=20
path in my copy of named.conf to be like this in ../logfiles:</div>
<div> </div>
<div>LogFile =3D /var/log/bind/bind.log</div>
<div> </div>
<div>and I also defined it in my copy of named.conf in ../services to rea=
d my=20
bind.log file like this:</div>
<div> </div>
<div>LogFile =3D bind</div>
<div> </div>
<div>I've also configured different scripts and services of Logwatch befo=
re=20
and they have been running perfectly well, with the only exception that t=
hey=20
were the "exact" ones so speak. For instance I customized dovecot for dov=
ecot,=20
proftpd for proftpd, spamassassin for spamassassin and so on but here we =
have=20
to customize the named for bind9 which in my understanding might be total=
ly=20
different and may require this named script=E2=80=99s and service=E2=80=
=99s thorough=20
re-writing (completely new script?). However, I am glad you are saying I =
am=20
all wrong and I would be thankful if you could assist me.</div>
<div> </div>
<div>It would be also nice to take a look at your bind9=E2=80=99s logging=
example, the=20
output it generates, and the output your named creates out of it when it'=
s=20
parsed.</div>
<div> </div>
<div>Many thanks in advance!</div>
<div> </div>
<div>Regards,</div>
<div>Dennis</div>
<div> </div>
<div>
<div style=3D"FONT-SIZE: small; FONT-FAMILY: 'Calibri'; FONT-WEIGHT: norm=
al; COLOR: #000000; FONT-STYLE: normal; TEXT-DECORATION: none; DISPLAY: inl=
ine"><font size=3D"3" face=3D"Calibri"></font></div>
<div style=3D"FONT: 10pt tahoma">
<div style=3D"BACKGROUND: #f5f5f5">
<div style=3D"font-color: black"><b>From:</b> <a title=3D"frank@crawford.=
emu.id.au" href=3D"mailto:[email protected]">Frank Crawford</a> </di=
v>
<div><b>Sent:</b> Saturday, April 21, 2018 09:04</div>
<div><b>To:</b> <a title=3D"[email protected]" href=3D"mailto:klaip=
[email protected]">Klaipedaville on Google</a> ; <a title=3D"logwatch-deve=
[email protected]" href=3D"mailto:[email protected]=
t">logwatch-devel</a> ; <a title=3D"[email protected]" href=3D"mailto:orion@nw=
ra.com">Orion Poplawski</a> </div>
<div><b>Subject:</b> Re: [Logwatch-devel] Bind Service &=20
Script</div></div></div>
<div> </div></div>
<div style=3D"FONT-SIZE: small; FONT-FAMILY: 'Calibri'; FONT-WEIGHT: norm=
al; COLOR: #000000; FONT-STYLE: normal; TEXT-DECORATION: none; DISPLAY: inl=
ine">
<div>Dennis,</div>
<div> </div>
<div>Firstly, I would say that what you are logging there is an extension=
of=20
the standard logging in bind. While you have defined a new channel, you=
=20
haven't noted what categories are going there. The default_syslog channel=
=20
doesn't include category, severity or time, hence the default logwatch mo=
dule=20
doesn't pick up those extra fields.</div>
<div> </div>
<div>Anyway, you have two different items of concern, you can easily conf=
igure=20
logwatch to pickup the bind9 file by editing the appropriate service=20
configuration file.</div>
<div> </div>
<div>Now, what is the appropriate service gets a bit more tricky. Firstly=
,=20
what do you expect it to report on that particular output? It looks more =
like=20
what you would dump doing debugging of queries, especially since you have=
a=20
5Mb limit on the size, with 3 copies, so it would rotate pretty quickly, =
and=20
logwatch really is normally run on daily logs, not transient logs.</div>
<div> </div>
<div>Once you work out what you want to report, I'd argue that you still =
want=20
to use the named script, it already understands bind9 output (I run it ac=
ross=20
my nameservers and it reports the operational issues fine). You would pro=
bably=20
want to add additional pattern matches because, as you say, it doesn't=
=20
currently match those lines. I can guess some stats you may want, but tha=
t may=20
be different to your requirements.</div>
<div> </div>
<div>If you can work out what you want I can suggest what you need to do =
to=20
get it reported, and then it can be rolled into the distribution.</div>
<div> </div>
<div>Regards</div>
<div>Frank</div>
<div> </div>
<div>On Thu, 2018-04-19 at 21:19 +0300, Klaipedaville on Google wrote:</d=
iv>
<blockquote type=3D"cite" style=3D"margin:0 0 0 .8ex; border-left:2px #72=
9fcf solid;padding-left:1ex">
<div dir=3D"ltr">
<div style=3D"FONT-SIZE: 12pt; FONT-FAMILY: 'Calibri'; COLOR: #000000">
<div>Hi Frank,</div>
<div> </div>
<div>Thank you for replying.</div>
<div> </div>
<div>Well, the "named module" that is the name script and service of=
=20
Logwatch do not really parse the Bind9=E2=80=99s log files as I=E2=80=
=99ve mentioned in my=20
first message before. Bind recommends custom logging because when you l=
eave=20
it "dropping" right into your syslog it does not really reflect the rea=
l=20
picture so to speak. Now when you set it up as per Bind=E2=80=99s recom=
mendations=20
then there is nothing reported by Logwatch because there is nothing "du=
mped"=20
into your syslog any more where Logwatch picks up "named module logging=
"=20
from. That=E2=80=99s why I was asking if there were any work arounds to=
make=20
Logwatch report on Bind9's?.. I thought that Bind=E2=80=99s script and =
service in=20
Logwatch were required.. was I wrong? Thanks.</div>
<div> </div>
<div>Regards,</div>
<div>Dennis</div>
<div> </div>
<div>P.S. I provided log examples in my first email to try to parse it =
/=20
feed it through "named module"... it did not work my side...</div>
<div> </div>
<div> </div>
<div style=3D"FONT-SIZE: small; FONT-FAMILY: 'Calibri'; FONT-WEIGHT: no=
rmal; COLOR: #000000; FONT-STYLE: normal; TEXT-DECORATION: none; DISPLAY: i=
nline">
<div style=3D"FONT: 10pt tahoma">
<div><font size=3D"3" face=3D"Calibri"></font> </div>
<div style=3D"BACKGROUND: #f5f5f5">
<div style=3D"font-color: black"><b>From:</b> <a title=3D"frank@crawfor=
d.emu.id.au" href=3D"mailto:[email protected]">Frank=20
Crawford</a> </div>
<div><b>Sent:</b> Thursday, April 19, 2018 15:05</div>
<div><b>To:</b> <a title=3D"[email protected]" href=3D"mailto:kla=
[email protected]">Klaipedaville on Google</a> ; <a title=3D"logwatch-de=
[email protected]" href=3D"mailto:[email protected]=
net">logwatch-devel</a> ; <a title=3D"[email protected]" href=3D"mailto:orion@=
nwra.com">Orion Poplawski</a> </div>
<div><b>Subject:</b> Re: [Logwatch-devel] Bind Service &=20
Script</div></div></div>
<div> </div></div>
<div style=3D"FONT-SIZE: small; FONT-FAMILY: 'Calibri'; FONT-WEIGHT: no=
rmal; COLOR: #000000; FONT-STYLE: normal; TEXT-DECORATION: none; DISPLAY: i=
nline">
<div>Dennis,</div>
<div> </div>
<div>Isn't the "named" module what you need? It does look through=20
/var/log/messages for the output, not a dedicated bind file, but still =
it is=20
what I see for my DNS server output.</div>
<div> </div>
<div>Frank</div>
<div> </div>
<div>On Wed, 2018-04-18 at 17:28 +0300, Klaipedaville on Google wrote:<=
/div>
<blockquote type=3D"cite" style=3D"margin:0 0 0 .8ex; border-left:2px #=
729fcf solid;padding-left:1ex">
<div dir=3D"ltr">
<div style=3D"FONT-SIZE: 12pt; FONT-FAMILY: 'Calibri'; COLOR: #000000=
">
<div>Hello everybody, </div>
<div> </div>
<div>I can=E2=80=99t believe it that the latest Logwatch 7.4.3 still =
does not have=20
any Bind services and scripts. Am I wrong? I tried to "feed" bind9=E2=
=80=99s=20
regular log files to named but it won=E2=80=99t parse them. Could any=
body advise,=20
please on how to make Logwatch "report" Bind? The standard / regular =
log=20
files in Bind9 are setup like this:</div>
<div> </div>
<div>logging {</div>
<div>channel bind_log {</div>
<div>file "/var/log/bind/bind.log" versions 3 size 5m;</div>
<div>severity info;</div>
<div>print-category yes;</div>
<div>print-severity yes;</div>
<div>print-time yes;</div>
<div> };</div>
<div>};</div>
<div> </div>
<div>and what the logging produces as the outcome looks like this:</d=
iv>
<div> </div>
<div>18-Apr-2018 11:36:14.961 queries: info: client 1.2.3.4#52132: qu=
ery:=20
ns2.barcap.com IN A + (1.2.3.4)</div>
<div>18-Apr-2018 11:36:14.961 queries: info: client 1.2.3.4#52132: qu=
ery:=20
a10-66.akam.net IN A + (1.2.3.4)</div>
<div>18-Apr-2018 11:36:14.962 queries: info: client 1.2.3.4#52132: qu=
ery:=20
a9-66.akam.net IN A + (1.2.3.4)</div>
<div>18-Apr-2018 11:36:14.962 queries: info: client 1.2.3.4#132: quer=
y:=20
ns7.barcap.com IN A + (1.2.3.4)</div>
<div>18-Apr-2018 11:36:14.963 queries: info: client 1.2.3.4#52132: qu=
ery:=20
ns3.barcap.com IN A + (1.2.3.4)</div>
<div>18-Apr-2018 11:36:14.963 queries: info: client 1.2.3.4#52132: qu=
ery:=20
a1-71.akam.net IN A + (1.2.3.4)</div>
<div>18-Apr-2018 11:36:14.964 queries: info: client 1.12.3.4#52132: q=
uery:=20
a12-64.akam.net IN A + (1.2.3.4)</div>
<div> </div>
<div>I would be really grateful for any pointers, suggestions,=20
recommendations, assistance.</div>
<div> </div>
<div>Many thanks in advance!</div>
<div> </div>
<div>Regards,</div>
<div>Dennis</div>
<div>
<div style=3D"FONT-SIZE: small; FONT-FAMILY: 'Calibri'; FONT-WEIGHT: =
normal; COLOR: #000000; FONT-STYLE: normal; TEXT-DECORATION: none; DISPLAY:=
inline"></div> </div></div></div><pre>-------------------------------=
-----------------------------------------------</pre><pre>Check out the vib=
rant tech community on one of the world's most</pre><pre>engaging tech site=
s, Slashdot.org! <a href=3D"http://sdm.link/slashdot">http://sdm.link/slash=
dot</a></pre><pre>_______________________________________________</pre><pre=
>Logwatch-devel mailing list</pre><pre><a href=3D"mailto:Logwatch-devel@lis=
ts.sourceforge.net">[email protected]</a></pre><pre><a h=
ref=3D"https://lists.sourceforge.net/lists/listinfo/logwatch-devel">https:/=
/lists.sourceforge.net/lists/listinfo/logwatch-devel</a></pre><pre><br></pr=
e></blockquote></div></div></div></blockquote></div></div></div></blockquot=
e>
<p>
</p><hr>
<p>
</p><hr>
_______________________________________________<br>Logwatch-devel mailing=
=20
list<br>[email protected]<br>https://lists.sourceforge.n=
et/lists/listinfo/logwatch-devel<br></div></div></div>
</blockquote></body></html>
--=-yp7Q+LbmoxNfM2ucp/rL--
--===============6750771469417893355==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
--===============6750771469417893355==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
_______________________________________________
Logwatch-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/logwatch-devel
--===============6750771469417893355==--