Turn on or enable BIND DNS server logging to see all queries or for troubleshooting problem

by on June 19, 2007 · 8 comments· LAST UPDATED June 26, 2007

in , ,

Q. How do I turn on DNS server logging so that I can see all the queries on my CentOS 4.0 server?

A. You can use rndc command which controls the operation of a name server. It supersedes the ndc utility that was provided in old BIND releases. If rndc is invoked with no command line options or arguments, it prints a short summary of the supported commands and the available options and their arguments.

rndc communicates with the name server over a TCP connection, sending commands authenticated with digital signatures. In the current versions of rndc and named named the only supported authentication algorithm is HMAC-MD5, which uses a shared secret on each end of the connection. This provides TSIG-style authentication for the command request and the name server\u2019s response. All commands sent over the channel must be signed by a key_id known to the server.

Task: Turn on logging

Type the following command as root to toggle query logging:
# rndc querylog

Task: View bind sever query log

Once this is done, you can view all logged queries usimg /var/log/messages file. To view those queries, type:
# tail -f /var/log/messages

Task: Turn off logging

Type the following command as root to toggle query logging:
# rndc querylog

TwitterFacebookGoogle+PDF versionFound an error/typo on this page? Help us!

{ 8 comments… read them below or add one }

1 Scott December 10, 2010 at 8:27 pm

Perfect! Thanks!

Reply

2 Prasad Chandorkar March 1, 2012 at 7:55 am

True

Thanks a lot.

Reply

3 Talk May 30, 2012 at 5:51 am

Thanks a lot for this hint!!!

Reply

4 Alparslan August 6, 2012 at 1:44 pm

is there any program or service to monitoring witch domain name is used and querying by any client.

I want to a linux bind9 dns query log analyser etc.

Reply

5 tonic January 9, 2013 at 1:25 pm

In the case of debian system like mine (wheezy), I had to tail /var/log/syslog instead of /var/log/messages :)

Reply

6 Sayantan Khan June 16, 2014 at 11:52 am

Thanks a lot for that debian specific information.

Reply

7 Tony June 11, 2014 at 3:57 pm

Excellent, thank you so much!

Reply

8 Tony June 26, 2014 at 9:43 pm

Thank you!!!

Reply

Leave a Comment

Tagged as: , , , , , ,

Previous Faq:

Next Faq: