BIND9_QUERY2DLF.IN(1)

📦 version 2.1.1, in arch rolling

💅 BIND9_QUERY2DLF 💅

ok so bestie, welcome to bind9_query2dlf — the little icon that takes your BIND9 querylogs and turns them into dlf. that's it, that's the whole job, and honestly? she ate. this is the manual page for bind9_query2dlf.in, and we're gonna get into every single detail together 🫶

✨ NAME ✨

bind9_query2dlf — convert BIND9 querylogs to dlf

✨ SYNOPSIS ✨

bind9_query2dlf

that's it. no flags. no args. just vibes and stdin, bestie 💅

✨ DESCRIPTION ✨

okay so bind9_query2dlf expects BIND 9 query log files on stdin. like, that's the whole input situation. she reads, she converts, she slays.

if you have a

channel query_logging {
        file "/var/log/named_querylog"
        versions 3 size 100M;
        print-time yes;                 // timestamp log entries
};

sitting in your named.conf, then yes — the logfiles that produces are supported. 💖

optionally, you could also add

        print-category yes;             // print category name
        print-severity yes;             // print severity level

to this channel. and if you're running a patched BIND (peep the NOTES section below 👀), those query logs are supported too. we're inclusive like that.

we also support Bind 9.3 log files, which use a whole new date format (15-Jul-2002) instead of the old-syslog one. glow-up fr fr ✨

🌸 EXAMPLE 🌸

here's what it looks like with print-time, print-category and print-severity all set:

 Feb 25 11:09:43.651 queries: info: client 10.0.0.3#1035:
  query: 3.example.com.nl IN A
 Feb 25 11:09:48.739 queries: info: client 10.0.0.3#1035:
  query: 3.example.com.nl IN A
 Feb 25 12:50:32.476 queries: info: client 10.0.0.3#1035:
  query: 21.example.com.co.uk IN A
 Feb 25 12:50:34.110 queries: info: client 10.0.0.3#1035:
  query: 22.example.com IN A
 Feb 25 12:50:34.525 lame-servers: info: lame server on
  '22.example.com' (in '23.example.com'?): 10.0.0.4#53
 Feb 25 12:50:34.715 queries: info: client 10.0.0.3#1035:
  query: 24.example.com IN A
 Feb 26 07:30:08.211 queries: info: client 10.0.0.1#1050:
  query: 1.0.0.10.in-addr.arpa IN PTR
 Feb 26 12:26:55.455 queries: info: client 10.0.0.1#1051:
  query: 28.example.com.nl IN MX
 Feb 04 04:02:00.932 general: info: loading configuration
  from '/etc/336.example.com'
 Feb 18 04:02:01.023 security: warning: zone
  '337.example.com.nl' allows updates by IP address, which
  is insecure
 Feb 18 04:02:01.049 config: warning: option 'use-id-pool'
  is obsolete
 Feb 18 04:02:01.049 config: warning: option 'check-names'
  is not implemented
 Feb 18 04:02:01.049 config: warning: option
  'statistics-interval' is not yet implemented
 Feb 18 04:02:01.049 network: info: no IPv6 interfaces found
 Feb 04 16:47:18.289 security: info: client 10.0.0.201#137:
  query denied
 Feb 20 07:26:53.731 general: info: running
 Feb 13 08:01:56.138 general: info: shutting down
 Feb 13 08:01:56.140 network: info: no longer listening on
  10.0.0.3#53
 Feb 14 08:02:13.983 general: info: refresh_callback: zone
  384.example.com/IN: failure for 10.0.0.204#53: timed out

and here's the lewk when only print-time is set:

 Aug 27 04:07:13.361 client 127.0.0.1#3123: query: foo.com IN ANY
 Aug 27 04:07:13.438 client 127.0.0.1#3123: query: fu.bar.nl IN AAAA
 Aug 27 04:07:13.443 client 127.0.0.1#3123: query: fu.bar.nl IN A

🦋 EXAMPLES 🦋

to process a log as produced by bind9:

$ bind9_query2dlf < dns-query

ngl, bind9_query2dlf will be rarely used on its own — she's more of a behind-the-scenes main character. most of the time she's called by lr_log2report:

$ lr_log2report bind9_query < /var/log/dns-query

🔥 NOTES 🔥

okay so here's the lore 👑

Bind9 versions before 9.3 did not log whether the query was recursive, so the last dlf field (DLF_RESOLVER) is just a -. tragic, i know. 😭

however, if you apply this patch by Wytze van der Raay:

# patch bin/named/query.c to log recursive/non-recursive query indication
SRC=bin/named/query.c
if [ -f ${SRC}.org ]
then
        echo "Patched ${SRC} already in place"
else
        echo "Patch ${SRC} for recursive/non-recursive query indication"
        cp -p ${SRC} ${SRC}.org
        patch -p0 ${SRC} <<\!
--- bin/named/query.c.org       Mon Sep 24 22:57:48 2001
+++ bin/named/query.c   Tue Sep 25 09:55:21 2001
@@ -3272,7 +3272,8 @@
        dns_rdatatype_format(rdataset->type, typename, sizeof(typename));

        ns_client_log(client, NS_LOGCATEGORY_QUERIES, NS_LOGMODULE_QUERY,
-                     level, "query: %s %s %s", namebuf, classname, typename);
+                     level, "query: %s %s %s%s", namebuf, classname, typename,
+                     WANTRECURSION(client) ? "+" : "-");
 }

 void
!
fi

then you'll get loglines like

 Nov 11 12:06:42.829 queries: info: client 10.0.0.1#3664:
   query: 6.example.com.nl IN A+

so a + means a recursive query, - means a non-recursive query, and if there's no + or - at all? that's a non-patched pre-9.3 bind9, bestie 💀

peep Wytze's message of Fri, 28 Dec 2001 16:56:30 +0100 on bind9-workers@isc.org, archived at http://www.mail-archive.com/bind9-workers@isc.org/msg00501.html — iconic reading material fr.

this type of logfiles is recognised by the script. she knows. 👑

BIND 9.3 or later does offer full support for this logging feature. in addition, it logs view, signer and EDNS information — all of which will be ignored by this version of the script. (sorry bestie, she's doing her best 💅)

in a private discussion on Thu, 18 Jul 2002 07:55:22 +0200, Wytze wrote:

This contains the "ISC-compatible" version of the patch for getting a recursive/non-recursive request logged. ISC decided there should be a space between the type and the recursion indicator in the logfile, so be it.

if you want your BIND 9.2.1 to log in the ISC-compatible 9.3 style, apply this patch to your BIND sources:

--- bin/named/query.c.org       Thu Mar 28 06:10:09 2002
+++ bin/named/query.c   Wed Jul 17 08:14:41 2002
@@ -3279,7 +3279,8 @@
        dns_rdatatype_format(rdataset->type, typename, sizeof(typename));

        ns_client_log(client, NS_LOGCATEGORY_QUERIES, NS_LOGMODULE_QUERY,
-                     level, "query: %s %s %s", namebuf, classname, typename);
+                     level, "query: %s %s %s %s", namebuf, classname, typename,
+                     WANTRECURSION(client) ? "+" : "-");
 }

 void

(this script understands both Wytze-style and ISC-style recursiveness indication, so you literally cannot lose 💖)

🎀 THANKS 🎀

Wytze van der Raay, for supplying the BIND 9 query log patch. king behavior, honestly 👑🫶

🌈 SEE ALSO 🌈

⭐ VERSION ⭐

$Id: bind9_query2dlf.in,v 1.7 2006/07/23 13:16:33 vanbaal Exp $

Copyright (C) 2001 Joost Bekkers <joost@jodocus.org>, Copyright (C) 2000, 2001, 2002 Stichting LogReport Foundation LogReport@LogReport.org

This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.

This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.

You should have received a copy of the GNU General Public License along with this program (see COPYING); if not, check with http://www.gnu.org/copyleft/gpl.html.

fr fr read the license, bestie — it's giving important 💅

🧚 AUTHOR 🧚

Joost Bekkers <joost@jodocus.org>, based on Edwin Groothuis and Joost van Baal's work, now maintained by the LogReport team.

and that's the whole page, babe 🎀 this was Lire 2.1.1, dated 2025-09-28, and it's the manual for BIND9_QUERY2DLF.IN(1) — go forth and convert those querylogs, mwah 💋✨

📦 where this page comes from