.\" Automatically generated by Pod::Man 4.14 (Pod::Simple 3.40)
.\"
.\" Standard preamble:
.\" ========================================================================
.de Sp \" Vertical space (when we can't use .PP)
.if t .sp .5v
.if n .sp
..
.de Vb \" Begin verbatim text
.ft CW
.nf
.ne \\$1
..
.de Ve \" End verbatim text
.ft R
.fi
..
.\" Set up some character translations and predefined strings.  \*(-- will
.\" give an unbreakable dash, \*(PI will give pi, \*(L" will give a left
.\" double quote, and \*(R" will give a right double quote.  \*(C+ will
.\" give a nicer C++.  Capital omega is used to do unbreakable dashes and
.\" therefore won't be available.  \*(C` and \*(C' expand to `' in nroff,
.\" nothing in troff, for use with C<>.
.tr \(*W-
.ds C+ C\v'-.1v'\h'-1p'\s-2+\h'-1p'+\s0\v'.1v'\h'-1p'
.ie n \{\
.    ds -- \(*W-
.    ds PI pi
.    if (\n(.H=4u)&(1m=24u) .ds -- \(*W\h'-12u'\(*W\h'-12u'-\" diablo 10 pitch
.    if (\n(.H=4u)&(1m=20u) .ds -- \(*W\h'-12u'\(*W\h'-8u'-\"  diablo 12 pitch
.    ds L" ""
.    ds R" ""
.    ds C` ""
.    ds C' ""
'br\}
.el\{\
.    ds -- \|\(em\|
.    ds PI \(*p
.    ds L" ``
.    ds R" ''
.    ds C`
.    ds C'
'br\}
.\"
.\" Escape single quotes in literal strings from groff's Unicode transform.
.ie \n(.g .ds Aq \(aq
.el       .ds Aq '
.\"
.\" If the F register is >0, we'll generate index entries on stderr for
.\" titles (.TH), headers (.SH), subsections (.SS), items (.Ip), and index
.\" entries marked with X<> in POD.  Of course, you'll have to process the
.\" output yourself in some meaningful fashion.
.\"
.\" Avoid warning from groff about undefined register 'F'.
.de IX
..
.nr rF 0
.if \n(.g .if rF .nr rF 1
.if (\n(rF:(\n(.g==0)) \{\
.    if \nF \{\
.        de IX
.        tm Index:\\$1\t\\n%\t"\\$2"
..
.        if !\nF==2 \{\
.            nr % 0
.            nr F 2
.        \}
.    \}
.\}
.rr rF
.\"
.\" Accent mark definitions (@(#)ms.acc 1.5 88/02/08 SMI; from UCB 4.2).
.\" Fear.  Run.  Save yourself.  No user-serviceable parts.
.    \" fudge factors for nroff and troff
.if n \{\
.    ds #H 0
.    ds #V .8m
.    ds #F .3m
.    ds #[ \f1
.    ds #] \fP
.\}
.if t \{\
.    ds #H ((1u-(\\\\n(.fu%2u))*.13m)
.    ds #V .6m
.    ds #F 0
.    ds #[ \&
.    ds #] \&
.\}
.    \" simple accents for nroff and troff
.if n \{\
.    ds ' \&
.    ds ` \&
.    ds ^ \&
.    ds , \&
.    ds ~ ~
.    ds /
.\}
.if t \{\
.    ds ' \\k:\h'-(\\n(.wu*8/10-\*(#H)'\'\h"|\\n:u"
.    ds ` \\k:\h'-(\\n(.wu*8/10-\*(#H)'\`\h'|\\n:u'
.    ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'^\h'|\\n:u'
.    ds , \\k:\h'-(\\n(.wu*8/10)',\h'|\\n:u'
.    ds ~ \\k:\h'-(\\n(.wu-\*(#H-.1m)'~\h'|\\n:u'
.    ds / \\k:\h'-(\\n(.wu*8/10-\*(#H)'\z\(sl\h'|\\n:u'
.\}
.    \" troff and (daisy-wheel) nroff accents
.ds : \\k:\h'-(\\n(.wu*8/10-\*(#H+.1m+\*(#F)'\v'-\*(#V'\z.\h'.2m+\*(#F'.\h'|\\n:u'\v'\*(#V'
.ds 8 \h'\*(#H'\(*b\h'-\*(#H'
.ds o \\k:\h'-(\\n(.wu+\w'\(de'u-\*(#H)/2u'\v'-.3n'\*(#[\z\(de\v'.3n'\h'|\\n:u'\*(#]
.ds d- \h'\*(#H'\(pd\h'-\w'~'u'\v'-.25m'\f2\(hy\fP\v'.25m'\h'-\*(#H'
.ds D- D\\k:\h'-\w'D'u'\v'-.11m'\z\(hy\v'.11m'\h'|\\n:u'
.ds th \*(#[\v'.3m'\s+1I\s-1\v'-.3m'\h'-(\w'I'u*2/3)'\s-1o\s+1\*(#]
.ds Th \*(#[\s+2I\s-2\h'-\w'I'u*3/5'\v'-.3m'o\v'.3m'\*(#]
.ds ae a\h'-(\w'a'u*4/10)'e
.ds Ae A\h'-(\w'A'u*4/10)'E
.    \" corrections for vroff
.if v .ds ~ \\k:\h'-(\\n(.wu*9/10-\*(#H)'\s-2\u~\d\s+2\h'|\\n:u'
.if v .ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'\v'-.4m'^\v'.4m'\h'|\\n:u'
.    \" for low resolution devices (crt and lpr)
.if \n(.H>23 .if \n(.V>19 \
\{\
.    ds : e
.    ds 8 ss
.    ds o a
.    ds d- d\h'-1'\(ga
.    ds D- D\h'-1'\(hy
.    ds th \o'bp'
.    ds Th \o'LP'
.    ds ae ae
.    ds Ae AE
.\}
.rm #[ #] #H #V #F C
.\" ========================================================================
.\"
.IX Title "BIND9_QUERY2DLF.IN 1"
.TH BIND9_QUERY2DLF.IN 1 "2020-07-07" "Lire 2.1.1" "LogReport's Lire Documentation"
.\" For nroff, turn off justification.  Always turn off hyphenation; it makes
.\" way too many mistakes in technical documents.
.if n .ad l
.nh
.SH "NAME"
bind9_query2dlf \- convert BIND9 querylogs to dlf
.SH "SYNOPSIS"
.IX Header "SYNOPSIS"
\&\fBbind9_query2dlf\fR
.SH "DESCRIPTION"
.IX Header "DESCRIPTION"
bind9_query2dlf expects \s-1BIND 9\s0 query log files on stdin.
.PP
If you have a
.PP
.Vb 5
\&        channel query_logging {
\&                file "/var/log/named_querylog"
\&                versions 3 size 100M;
\&                print\-time yes;                 // timestamp log entries
\&        };
.Ve
.PP
in your named.conf, the produced logfiles are supported.  Optionally, you
could add
.PP
.Vb 2
\&                print\-category yes;             // print category name
\&                print\-severity yes;             // print severity level
.Ve
.PP
to this channel.  Query logs as produced by a patched \s-1BIND\s0 (see \s-1NOTES\s0 below)
are supported too.
.PP
We also support Bind 9.3 log file which uses a new date format
(15\-Jul\-2002) instead of the old-syslog one.
.SH "EXAMPLE"
.IX Header "EXAMPLE"
With print-time, print-category and print-severity set:
.PP
.Vb 10
\& Feb 25 11:09:43.651 queries: info: client 10.0.0.3#1035:
\&  query: 3.example.com.nl IN A
\& Feb 25 11:09:48.739 queries: info: client 10.0.0.3#1035:
\&  query: 3.example.com.nl IN A
\& Feb 25 12:50:32.476 queries: info: client 10.0.0.3#1035:
\&  query: 21.example.com.co.uk IN A
\& Feb 25 12:50:34.110 queries: info: client 10.0.0.3#1035:
\&  query: 22.example.com IN A
\& Feb 25 12:50:34.525 lame\-servers: info: lame server on
\&  \*(Aq22.example.com\*(Aq (in \*(Aq23.example.com\*(Aq?): 10.0.0.4#53
\& Feb 25 12:50:34.715 queries: info: client 10.0.0.3#1035:
\&  query: 24.example.com IN A
\& Feb 26 07:30:08.211 queries: info: client 10.0.0.1#1050:
\&  query: 1.0.0.10.in\-addr.arpa IN PTR
\& Feb 26 12:26:55.455 queries: info: client 10.0.0.1#1051:
\&  query: 28.example.com.nl IN MX
\& Feb 04 04:02:00.932 general: info: loading configuration
\&  from \*(Aq/etc/336.example.com\*(Aq
\& Feb 18 04:02:01.023 security: warning: zone
\&  \*(Aq337.example.com.nl\*(Aq allows updates by IP address, which
\&  is insecure
\& Feb 18 04:02:01.049 config: warning: option \*(Aquse\-id\-pool\*(Aq
\&  is obsolete
\& Feb 18 04:02:01.049 config: warning: option \*(Aqcheck\-names\*(Aq
\&  is not implemented
\& Feb 18 04:02:01.049 config: warning: option
\&  \*(Aqstatistics\-interval\*(Aq is not yet implemented
\& Feb 18 04:02:01.049 network: info: no IPv6 interfaces found
\& Feb 04 16:47:18.289 security: info: client 10.0.0.201#137:
\&  query denied
\& Feb 20 07:26:53.731 general: info: running
\& Feb 13 08:01:56.138 general: info: shutting down
\& Feb 13 08:01:56.140 network: info: no longer listening on
\&  10.0.0.3#53
\& Feb 14 08:02:13.983 general: info: refresh_callback: zone
\&  384.example.com/IN: failure for 10.0.0.204#53: timed out
.Ve
.PP
With only print-time set:
.PP
.Vb 3
\& Aug 27 04:07:13.361 client 127.0.0.1#3123: query: foo.com IN ANY
\& Aug 27 04:07:13.438 client 127.0.0.1#3123: query: fu.bar.nl IN AAAA
\& Aug 27 04:07:13.443 client 127.0.0.1#3123: query: fu.bar.nl IN A
.Ve
.SH "EXAMPLES"
.IX Header "EXAMPLES"
To process a log as produced by bind9:
.PP
.Vb 1
\& $ bind9_query2dlf < dns\-query
.Ve
.PP
bind9_query2dlf will be rarely used on its own, but is more likely
called by lr_log2report:
.PP
.Vb 1
\& $ lr_log2report bind9_query < /var/log/dns\-query
.Ve
.SH "NOTES"
.IX Header "NOTES"
Bind9 versions before 9.3 did not log wether the query was recursive,
therefore the last dlf field (\s-1DLF_RESOLVER\s0) is a '\-'.  However,
applying this patch by Wytze van der Raay:
.PP
.Vb 10
\& # patch bin/named/query.c to log recursive/non\-recursive query indication
\& SRC=bin/named/query.c
\& if [ \-f ${SRC}.org ]
\& then
\&         echo "Patched ${SRC} already in place"
\& else
\&         echo "Patch ${SRC} for recursive/non\-recursive query indication"
\&         cp \-p ${SRC} ${SRC}.org
\&         patch \-p0 ${SRC} <<\e!
\& \-\-\- bin/named/query.c.org       Mon Sep 24 22:57:48 2001
\& +++ bin/named/query.c   Tue Sep 25 09:55:21 2001
\& @@ \-3272,7 +3272,8 @@
\&         dns_rdatatype_format(rdataset\->type, typename, sizeof(typename));
\&
\&         ns_client_log(client, NS_LOGCATEGORY_QUERIES, NS_LOGMODULE_QUERY,
\& \-                     level, "query: %s %s %s", namebuf, classname, typename);
\& +                     level, "query: %s %s %s%s", namebuf, classname, typename,
\& +                     WANTRECURSION(client) ? "+" : "\-");
\&  }
\&
\&  void
\& !
\& fi
.Ve
.PP
will yield loglines like
.PP
.Vb 2
\& Nov 11 12:06:42.829 queries: info: client 10.0.0.1#3664:
\&   query: 6.example.com.nl IN A+
.Ve
.PP
A '+' indicates a recursive query, \- indicates a non-recursive query,
the lack of + or \- indicates a non-patched pre\-9.3 bind9.  See Wytze's message
of Fri, 28 Dec 2001 16:56:30 +0100 on bind9\-workers@isc.org , archived
at http://www.mail\-archive.com/bind9\-workers@isc.org/msg00501.html .
.PP
This type of logfiles is recognised by the script.
.PP
\&\s-1BIND 9.3\s0 or later does offer full support for this logging feature.
In addition, it logs view, signer and \s-1EDNS\s0 information, all of which
will be ignored by this version of the script.
.PP
In a private discussion on Thu, 18 Jul 2002 07:55:22 +0200, Wytze wrote:
.PP
.Vb 3
\& This contains the "ISC\-compatible" version of  the patch for getting a
\& recursive/non\-recursive request logged. ISC decided there should be a space
\& between the type and the recursion indicator in the logfile, so be it.
.Ve
.PP
If you want to have your \s-1BIND 9.2.1\s0 to log in the ISC-compatible 9.3 style,
apply this patch to your \s-1BIND\s0 sources:
.PP
.Vb 4
\& \-\-\- bin/named/query.c.org       Thu Mar 28 06:10:09 2002
\& +++ bin/named/query.c   Wed Jul 17 08:14:41 2002
\& @@ \-3279,7 +3279,8 @@
\&         dns_rdatatype_format(rdataset\->type, typename, sizeof(typename));
\&
\&         ns_client_log(client, NS_LOGCATEGORY_QUERIES, NS_LOGMODULE_QUERY,
\& \-                     level, "query: %s %s %s", namebuf, classname, typename);
\& +                     level, "query: %s %s %s %s", namebuf, classname, typename,
\& +                     WANTRECURSION(client) ? "+" : "\-");
\&  }
\&
\&  void
.Ve
.PP
\&.  This script understands both Wytze-style and ISC-style recursiveness
indication.
.SH "THANKS"
.IX Header "THANKS"
Wytze van der Raay, for supplying the \s-1BIND 9\s0 query log patch.
.SH "SEE ALSO"
.IX Header "SEE ALSO"
\&\fBbind8_query2dlf\fR\|(1), The bind9 online documentation, as distributed with \s-1BIND\s0
(but unfortunately not online at http://isc.org/ , you might like
http://doc.mdcc.cx/doc/bind/html/logging.html though)
.SH "VERSION"
.IX Header "VERSION"
\&\f(CW$Id:\fR bind9_query2dlf.in,v 1.7 2006/07/23 13:16:33 vanbaal Exp $
.SH "COPYRIGHT"
.IX Header "COPYRIGHT"
Copyright (C) 2001 Joost Bekkers <joost@jodocus.org>,
Copyright (C) 2000, 2001, 2002 Stichting LogReport Foundation LogReport@LogReport.org
.PP
This program is free software; you can redistribute it and/or modify
it under the terms of the \s-1GNU\s0 General Public License as published by
the Free Software Foundation; either version 2 of the License, or
(at your option) any later version.
.PP
This program is distributed in the hope that it will be useful,
but \s-1WITHOUT ANY WARRANTY\s0; without even the implied warranty of
\&\s-1MERCHANTABILITY\s0 or \s-1FITNESS FOR A PARTICULAR PURPOSE.\s0  See the
\&\s-1GNU\s0 General Public License for more details.
.PP
You should have received a copy of the \s-1GNU\s0 General Public License
along with this program (see \s-1COPYING\s0); if not, check with
http://www.gnu.org/copyleft/gpl.html.
.SH "AUTHOR"
.IX Header "AUTHOR"
Joost Bekkers <joost@jodocus.org>, based on Edwin Groothuis and Joost
van Baal's work, now maintained by the LogReport team.