"Fossies" - the Fresh Open Source Software Archive

Member "bind-9.16.7/doc/arm/logging-categories.rst" (4 Sep 2020, 6274 Bytes) of package /linux/misc/dns/bind9/9.16.7/bind-9.16.7.tar.xz:

As a special service "Fossies" has tried to format the requested source page into HTML format (assuming markdown format). Alternatively you can here view or download the uninterpreted source code file. A member file download can also be achieved by clicking within a package contents listing on the according byte size field. See also the last Fossies "Diffs" side-by-side code changes report for "logging-categories.rst": 9.17.2_vs_9.17.3.


Processing of client requests.


Nameservers that are skipped due to them being a CNAME rather than A / AAAA records.


Configuration file parsing and processing.


Messages relating to the databases used internally by the name server to store zone and cache data.


Logging options for those categories where no specific configuration has been defined.


Queries that have been forced to NXDOMAIN as the result of a delegation-only zone or a delegation-only in a forward, hint, or stub zone declaration.


Dispatching of incoming packets to the server modules where they are to be processed.


DNSSEC and TSIG protocol processing.


The "dnstap" DNS traffic capture system.


Log queries that have been forced to use plain DNS due to timeouts. This is often due to the remote servers not being 1034-compliant (not always returning FORMERR or similar to EDNS queries and other extensions to the DNS when they are not understood). In other words, this is targeted at servers that fail to respond to DNS queries that they don't understand.

Note: the log message can also be due to packet loss. Before reporting servers for non-1034 compliance they should be re-tested to determine the nature of the non-compliance. This testing should prevent or reduce the number of false-positive reports.

Note: eventually named will have to stop treating such timeouts as due to 1034 non-compliance and start treating it as plain packet loss. Falsely classifying packet loss as due to 1034 non-compliance impacts DNSSEC validation, which requires EDNS for the DNSSEC records to be returned.


Catch-all for many things that still are not classified into categories.


Misconfigurations in remote servers, discovered by BIND 9 when trying to query those servers during resolution.


Network operations.


The NOTIFY protocol.


NSID options received from upstream servers.


Location where queries should be logged.

At startup, specifying the category queries also enables query logging unless the querylog option has been specified.

The query log entry first reports a client object identifier in @0x<hexadecimal-number> format. Next, it reports the client's IP address and port number, and the query name, class, and type. Next, it reports whether the Recursion Desired flag was set (+ if set, - if not set), whether the query was signed (S), whether EDNS was in use along with the EDNS version number (E(#)), whether TCP was used (T), whether DO (DNSSEC Ok) was set (D), whether CD (Checking Disabled) was set (C), whether a valid DNS Server COOKIE was received (V), and whether a DNS COOKIE option without a valid Server COOKIE was present (K). After this, the destination address the query was sent to is reported. Finally, if any CLIENT-SUBNET option was present in the client query, it is included in square brackets in the format [ECS address/source/scope].

client (www.example.com): query: www.example.com IN AAAA +SE client ::1#62537 (www.example.net): query: www.example.net IN AAAA -SE

(The first part of this log message, showing the client address/port number and query name, is repeated in all subsequent log messages related to the same query.)


Information about queries that resulted in some failure.


Start, periodic, and final notices of the rate limiting of a stream of responses that are logged at info severity in this category. These messages include a hash value of the domain name of the response and the name itself, except when there is insufficient memory to record the name for the final notice. The final notice is normally delayed until about one minute after rate limiting stops. A lack of memory can hurry the final notice, which is indicated by an initial asterisk (*). Various internal events are logged at debug 1 level and higher.

Rate limiting of individual requests is logged in the query-errors category.


DNS resolution, such as the recursive lookups performed on behalf of clients by a caching name server.


Information about errors in response policy zone files, rewritten responses, and, at the highest debug levels, mere rewriting attempts.


Approval and denial of requests.


Indication of whether a stale answer is used following a resolver failure.


Queries that have been terminated, either by dropping or responding with SERVFAIL, as a result of a fetchlimit quota being exceeded.


Trust-anchor-telemetry requests received by named.


Messages that named was unable to determine the class of, or for which there was no matching view. A one-line summary is also logged to the client category. This category is best sent to a file or stderr; by default it is sent to the null channel.


Dynamic updates.


Approval and denial of update requests.


Zone transfers the server is receiving.


Zone transfers the server is sending.


Loading of zones and creation of automatic empty zones.