bind8_named2dlf(1)

Usage

bind8_named2dlf

Overview

This script converts each line in a BIND8 named log to a dnszone dlf record. It is tested using Bind 8.2 logs. We're not aware of any changes in the logging format in any Bind 8.* version, we expect any bind 8.* log to get processed fine by this script.

The following lines are recognized:

`•`	approved/denied AXFR requests
`•`	completed zone transfers
`•`	loaded master and slave zones
`•`	denied dynamic DNS updates

DLF format

The DLF format of the dnszone superservice is

`server`	Name of the DNS server
`time`	Timestamp for the request
`axfr_host`	IP address of the host requesting the AXFR
`axfr_zone`	Name of the zone being requested
`axfr_what`	approved, denied or axfr
`loaded_zone`	Name of the zone just loaded
`loaded_serial`	Serial of the zone just loaded
`loaded_role`	master or slave
`updatedenied_host`	IP address of the host requesting the update
`updatedenied_zone`	Name of the zone being updated

Due to the nature of the different meanings of the lines in the logfile (not every line has both a AXFR-request, loaded a zone and gotten an update request), one or more fields can be replaced by a 0 or a -. These fields are automaticly filtered out for the different kind of reports.

Example of DLF lines are:

`AXFR approved`	tim 1026644876 10.10.10.1 algron.com approved - 0 - - -
`update denied`	tim 1026645567 - - - - 0 - 10.in-addr.arpa 10.199.16.218
`master zone loaded`	tim 1026525210 - - - nigelbowen.com.au 2002071301 master - -

Examples

To process a log as produced by bind8:

 $ bind8_named2dlf < named-log

bind8_named2dlf will be rarely used on its own, but is more likely called by lr_log2report:

 $ lr_log2report bind8_named < /var/log/named

Version

$Id: bind8_named2dlf.in,v 1.7 2004/10/13 10:17:27 vanbaal Exp $

Releases