DNS Logging

I checked out the article you listed, but when I open a terminal window and try

rndc status |grep query

I get:

rndc: connect failed: 127.0.0.1#953: connection refused

I receive the same error message if I try

rndc querylog on

All commands were run as root.

So I've located my named.conf file and found the section that controls logging:

logging {

channel "_default_log" {

file "/Library/Logs/named.log";

severity info;

print-time yes;

};

category "default" {

"_default_log";

};

From my inexperienced reading of the BIND documentation, the

severity info;

entry should be producing a some kind of log entry, correct?

cpragman wrote:

Wouldn't you need to increase the logging level of named first?

Check "man 5 named.conf" for details on logging levels.

Linc,

I don't see a /Library/Server/named/ directory, let alone /named/rndc.key

Linc Davis wrote:

RNDC should have been enabled automatically. Do you have the file /Library/Server/named/rndc.key?

/etc/rndc.key

exists

key "rndc-key" {

algorithm hmac-md5;

secret "(redacted)";

};

Linc,

Here's part of the named.conf file:

include "/etc/rndc.key";

options {

directory "/var/named";

allow-recursion {

com.apple.ServerAdmin.DNS.public;

};

allow-transfer {

none;

};

forwarders {

208.67.222.222;

208.67.220.220;

};

};

controls {

inet 127.0.0.1 port 54 allow {

"any";

} keys {

"rndc-key";

};

};

acl "com.apple.ServerAdmin.DNS.public" {

any;

};

logging {

channel "_default_log" {

file "/Library/Logs/named.log";

severity info;

print-time yes;

};

category "default" {

"_default_log";

};

};

Anything amiss?

btw: thanks for the help!

I restarted DNS service and started to get some log activity (still nothing from the rndc query you linked to, though).

If I want to increase the log level so that I can trace which internal clients are the ones querying the suspect domains, would I change the line in named.conf from

severity info;

to

severity debug;

If that is the right syntax, I imagine the procedure would be:

1) backup named.conf ( named.conf.old or something similar)

2) turn off dns

3) make change to named.conf

4) start dns

5) test log level

As you can tell I'm new to this (and obviously know just enough to really screw things up).

Thanks again,

Christopher