PDA

View Full Version : How do I get named to stop logging to /var/log/messages?



lpphiggp
09-Jun-2015, 21:32
We have named_queries enabled, but in addition to writing to /var/log/named/named_querylog as configured, it's also writing to /var/log/messages constantly, making it about useless for troubleshooting other, minor DNS issues I have that are beyond the scope of this post.
How do I make this stop?

Actually, I made it stop writing temporarily to /var/log/named/named_querylog because I was getting nervous about disk space.

Now if I can just get it to stop flooding /var/log/messages, I'd reenable the desired log.

Here's from the named.conf:


logging {
# channel "simple_log" {
# file "/log/bind.log" versions 3 size 5m;
# print-time yes;
# print-severity yes;
# print-category yes;
# };
# category default{
# "simple_log";
# };
channel query_logging {
# file "/var/log/named/named_querylog" versions 10 size 500M;
print-time yes; // timestamp log entries
syslog local6; //added by Dave for SEIM test
};

category queries {
query_logging;
};

};

And this is from the syslog-ng.conf file:(ultimately we want to use an external syslog server but right now it's down so commented out)



# Filter definitions
#
filter f_named {facility (local6);};
filter f_messages { not facility(news, mail) and not filter(f_iptables); };
(and some other filters here not relevant to the issue)


# Enable this and adopt IP to send log messages to a log server.
#
#destination logserver { udp("10.111.3.42" port(514)); };
#log { source(src); destination(logserver); };
#
#
# Logging for Named
# destination dnslog { file("/var/log/named/namedquery.log" owner(root) group(root)); };
#log { source(src) ; filter(f_named); destination(dnslog); };
#SEIM Added as destination for dns logs

# destination seim { udp("10.111.254.9" port(514)); };
# log { source(src) ; filter(f_named); destination(seim);
#
#
# All messages except iptables and the facilities news and mail:
#
destination messages { file("/var/log/messages"); };
log { source(src); filter(f_messages); destination(messages); };




I'm thinking something like this: ?

filter f_messages { not facility(news, mail, local6) and not filter(f_iptables, f_named) ; };

smflood
10-Jun-2015, 10:54
On 09/06/2015 21:34, lpphiggp wrote:

> We have named_queries enabled, but in addition to writing to
> /var/log/named/named_querylog as configured, it's also writing to
> /var/log/messages constantly, making it about useless for
> troubleshooting other, minor DNS issues I have that are beyond the scope
> of this post.
> How do I make this stop?
>
> Actually, I made it stop writing temporarily to
> /var/log/named/named_querylog because I was getting nervous about disk
> space.
>
> Now if I can just get it to stop flooding /var/log/messages, I'd
> reenable the desired log.
>
> Here's from the named.conf:
>
>
> logging {
> # channel "simple_log" {
> # file "/log/bind.log" versions 3 size 5m;
> # print-time yes;
> # print-severity yes;
> # print-category yes;
> # };
> # category default{
> # "simple_log";
> # };
> channel query_logging {
> # file "/var/log/named/named_querylog" versions 10 size 500M;
> print-time yes; // timestamp log entries
> syslog local6; //added by Dave for SEIM test
> };
>
> category queries {
> query_logging;
> };
>
> };
>
> And this is from the syslog-ng.conf file:(ultimately we want to use an
> external syslog server but right now it's down so commented out)
>
>
>
> # Filter definitions
> #
> filter f_named {facility (local6);};
> filter f_messages { not facility(news, mail) and not
> filter(f_iptables); };
> (and some other filters here not relevant to the issue)
>
>
> # Enable this and adopt IP to send log messages to a log server.
> #
> #destination logserver { udp("10.111.3.42" port(514)); };
> #log { source(src); destination(logserver); };
> #
> #
> # Logging for Named
> # destination dnslog { file("/var/log/named/namedquery.log" owner(root)
> group(root)); };
> #log { source(src) ; filter(f_named); destination(dnslog); };
> #SEIM Added as destination for dns logs
>
> # destination seim { udp("10.111.254.9" port(514)); };
> # log { source(src) ; filter(f_named); destination(seim);
> #
> #
> # All messages except iptables and the facilities news and mail:
> #
> destination messages { file("/var/log/messages"); };
> log { source(src); filter(f_messages); destination(messages); };
>
>
>
>
> I'm thinking something like this: ?
>
> filter f_messages { not facility(news, mail, local6) and not
> filter(f_iptables, f_named) ; };

Yes you're on the right track with the above but it should be sufficient
to include f_named within the second filter and not local6 in the
facility test (I can't recall if including local6 will cause you other
problems). So you would end up with:

filter f_messages { not facility(news, mail) and not
filter(f_iptables, f_named) ; };

HTH.
--
Simon
SUSE Knowledge Partner

------------------------------------------------------------------------
If you find this post helpful and are logged into the web interface,
please show your appreciation and click on the star below. Thanks.
------------------------------------------------------------------------

lpphiggp
10-Jun-2015, 16:40
Thanks.. only that doesn't like that syntax on this box.. I get an error on trying to restart syslog with that line.
It's like it refuses to accept two filters.

new-remus:/etc/syslog-ng # rcsyslog start
Starting syslog servicessyntax error at 100
startproc: exit status of parent of /sbin/syslog-ng: 1
failed
new-remus:/etc/syslog-ng #

The conf is:

88 #
89 # acpid messages
90 #
91 filter f_acpid_full { match('^acpid:'); };
92 filter f_acpid { level(emerg..notice) and match('^acpid:'); };
93
94 # this is for the old acpid < 1.0.6
95 filter f_acpid_old { match('^\[acpid\]:'); };
96
97 filter f_netmgm { match('^NetworkManager:'); };
98
99 #filter f_messages { not facility(news, mail) and not filter(f_iptables); };
100 filter f_messages { not facility(news, mail) and not filter(f_iptables, f_named) ; };
101 filter f_warn { level(warn, err, crit) and not filter(f_iptables); };
102 filter f_alert { level(alert); };
103

smflood
10-Jun-2015, 17:01
On 10/06/2015 16:44, lpphiggp wrote:

> Thanks.. only that doesn't like that syntax on this box.. I get an
> error on trying to restart syslog with that line.
> It's like it refuses to accept two filters.
>
> new-remus:/etc/syslog-ng # rcsyslog start
> Starting syslog servicessyntax error at 100
> startproc: exit status of parent of /sbin/syslog-ng: 1
>
>
> failed
> new-remus:/etc/syslog-ng #
>
> The conf is:
>
> 88 #
> 89 # acpid messages
> 90 #
> 91 filter f_acpid_full { match('^acpid:'); };
> 92 filter f_acpid { level(emerg..notice) and match('^acpid:'); };
> 93
> 94 # this is for the old acpid < 1.0.6
> 95 filter f_acpid_old { match('^\[acpid\]:'); };
> 96
> 97 filter f_netmgm { match('^NetworkManager:'); };
> 98
> 99 #filter f_messages { not facility(news, mail) and not
> filter(f_iptables); };
> 100 filter f_messages { not facility(news, mail) and not
> filter(f_iptables, f_named) ; };
> 101 filter f_warn { level(warn, err, crit) and not
> filter(f_iptables); };
> 102 filter f_alert { level(alert); };
> 103

Ah sorry I think filter() can only take one filtername so you actually
have to do

filter f_messages { not facility(news, mail) and not filter(f_iptables)
and not filter(f_named) ; };

HTH.
--
Simon
SUSE Knowledge Partner

------------------------------------------------------------------------
If you find this post helpful and are logged into the web interface,
please show your appreciation and click on the star below. Thanks.
------------------------------------------------------------------------

lpphiggp
10-Jun-2015, 19:31
Ah sorry I think filter() can only take one filtername so you actually
have to do

filter f_messages { not facility(news, mail) and not filter(f_iptables)
and not filter(f_named) ; };

HTH.
--
Simon
SUSE Knowledge Partner

------------------------------------------------------------------------
If you find this post helpful and are logged into the web interface,
please show your appreciation and click on the star below. Thanks.
------------------------------------------------------------------------


Well, no error or failure of syslog this time, but named is still writing to messages.
Wow that's one determined lil logger.

I might try replace the "and not filter(f_iptables) with just "and not filter(f_named)" because we don't run a firewall on the server, we have dedicated firewalls all over the place for that.


EDIT Update: Nope.. lol. Still floods /var/log/messages with name queries., even with the above; I wonder if the f_named filter isn't defined wrong somehow.
I'm new to syslog, so this is rather daunting.

jmozdzen
11-Jun-2015, 13:06
Hi *,

why don't you disable named's logging to syslog?



channel query_logging {
# file "/var/log/named/named_querylog" versions 10 size 500M;
print-time yes; // timestamp log entries
syslog local6; //added by Dave for SEIM test
};

Comment out that channel and you're clean.

Regards,
Jens

lpphiggp
11-Jun-2015, 16:21
Hi *,

why don't you disable named's logging to syslog?

Comment out that channel and you're clean.

Regards,
Jens

We still want logging of queries, just to dedicated files:
Ideally, /var/log/named/named_query.log

I just don't want them in /var/log/messages.

Wouldn't that kill all logging for named?

jmozdzen
12-Jun-2015, 14:57
Hi lpphiggp,

We still want logging of queries, just to dedicated files:
Ideally, /var/log/named/named_query.log

I just don't want them in /var/log/messages.

Wouldn't that kill all logging for named?

you're right, I meant to say to comment out the syslog version of the channel:

We have named_queries enabled, but in addition to writing to /var/log/named/named_querylog as configured, it's also writing to /var/log/messages constantly, making it about useless for troubleshooting other, minor DNS issues I have that are beyond the scope of this post.
How do I make this stop?

Actually, I made it stop writing temporarily to /var/log/named/named_querylog because I was getting nervous about disk space.

Now if I can just get it to stop flooding /var/log/messages, I'd reenable the desired log.

Here's from the named.conf:
logging {
# channel "simple_log" {
# file "/log/bind.log" versions 3 size 5m;
# print-time yes;
# print-severity yes;
# print-category yes;
# };
# category default{
# "simple_log";
# };
channel query_logging {
# file "/var/log/named/named_querylog" versions 10 size 500M;
print-time yes; // timestamp log entries
syslog local6; //added by Dave for SEIM test
};

category queries {
query_logging;
};

};




You're explicitly directing query logging to syslog, but you complain that it does what it's supposed to do ;) But you made me curious, so I gave it a test run. Here's the logging part of my test named.conf:


logging {
# Log queries to a file limited to a size of 100 MB.
channel query_logging {
file "/var/log/named_querylog"
versions 3 size 100M;
print-time yes; // timestamp log entries
};
category queries {
query_logging;
};

# # Or log this kind alternatively to syslog.
# channel syslog_queries {
# syslog user;
# severity info;
# };
# category queries { syslog_queries; };

# Log general name server errors to syslog.
channel syslog_errors {
syslog user;
severity error;
};
category default { syslog_errors; };

# # Don't log lame server messages.
# category lame-servers { null; };
};

I have the queries logged to (/var/lib/named)/var/log/named_querylog and see no queries logged to syslog, only startup and error messages.

And concerning the "flooding the disk via request logging" part of your initial message: You're creating up to 10 500 MB files... that *is* a lot of queries to log, so you might go easy on that sizing. But as you set the limits, you know in advance how much space to keep free in that file system...

Regards,
Jens

lpphiggp
12-Jun-2015, 16:59
Hi lpphiggp,


you're right, I meant to say to comment out the syslog version of the channel:




You're explicitly directing query logging to syslog, but you complain that it does what it's supposed to do ;) But you made me curious, so I gave it a test run. Here's the logging part of my test named.conf:


H Jens, I think you missed the part where I said I've commented out the syslog local6 part and just reenabled the file channel but it still writes to /var/log/messages.
It's haunted. :eek:




logging {
# Log queries to a file limited to a size of 100 MB.
channel query_logging {
file "/var/log/named_querylog"
versions 3 size 100M;
print-time yes; // timestamp log entries
};
category queries {
query_logging;
};

# # Or log this kind alternatively to syslog.
# channel syslog_queries {
# syslog user;
# severity info;
# };
# category queries { syslog_queries; };

# Log general name server errors to syslog.
channel syslog_errors {
syslog user;
severity error;
};
category default { syslog_errors; };

# # Don't log lame server messages.
# category lame-servers { null; };
};

I have the queries logged to (/var/lib/named)/var/log/named_querylog and see no queries logged to syslog, only startup and error messages.

And concerning the "flooding the disk via request logging" part of your initial message: You're creating up to 10 500 MB files... that *is* a lot of queries to log, so you might go easy on that sizing. But as you set the limits, you know in advance how much space to keep free in that file system...

Regards,
Jens

We can accommodate the 10 500MB files so long as named isn't writing to /var/log/messages as well. Ultimately, management wants much older logs kept for security checks, but we'll have to get our proper SEIM syslog server running for that to happen.

I'll revisit this again this afternoon.. could you perhaps show me what your /etc/syslog-ng/syslog-ng.conf looks like regarding named and messages?
I'll emulate those in our environment and see how it goes.


Thanks

Paul

jmozdzen
29-Jun-2015, 16:31
Hi Paul,

sorry for the late reply - I was unavailable a few days on short notice.


H Jens, I think you missed the part where I said I've commented out the syslog local6 part and just reenabled the file channel but it still writes to /var/log/messages.
It's haunted. :eek:

Please help us by posting named.conf in the state that does create the unwanted log entries to syslog. And please check that none of the included sub-config files contain any according configuration that logs to syslog ;)


could you perhaps show me what your /etc/syslog-ng/syslog-ng.conf looks like regarding named and messages?
I'll emulate those in our environment and see how it goes.

We have no special filtering in our central syslog server configuration. And the machine running named has nothing special in its syslogd config, other than sending everything to the central syslogd...

Regards,
Jens