0

Im have this strange behaviour where my bind server is just forwarding info and notice errors to my remote syslog server.

Current configuration on the named.conf file is:

logging {
channel syslog
syslog localo;
severity info;
print-severity yes;
print-category yes;
print-time yes;
};

Of course that in both rsyslog.conf the line for bind is: local0.* Nevertheless I'm facing this problem, maybe im missing something.

1 Answer 1

2

Your BIND log configuration is missing one set of curly brackets, and localo should be local0. You'll also need one or more category keywords to send log messages to the custom logging channel you've just defined.

This is what it should look like:

logging {
        channel syslog {
                syslog local0;
                severity info;
                print-severity yes;
                print-category yes;
                print-time yes;
        };
        category default { syslog; };
        # if there are no other 'category' statements,
        # this will include everything except query logging.
};

If you have no category statements at all, BIND will only use its built-in default logging channels, one of which is default_syslog. It uses the syslog facility daemon, so the messages won't match the local0 facility you're expecting in your rsyslog.conf configuration.

You should use named-checkconf to check your named.conf for syntax errors. See https://bind.isc.org/doc/arm/9.11/man.named-checkconf.html for more information.

1
  • Yeah, that's exactly what I had but still doesnt work. The missing curly brackets were because I copy pasted the text from a screenshot. Sorry about the super beyond answer have been very busy with tons of exams. Anyways, ill give you the correct answer because its supposed to be like that, but somehow it doest work. If I test the facility it forwards correctly nevertheless. Mar 31 at 22:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.