1.3. Configuring logging on a BIND DNS server

Procedure

1. Edit the /etc/named.conf file, and add category and channel phrases to the logging statement, for example:

   logging {
       ...
   
       category notify { zone_transfer_log; };
       category xfer-in { zone_transfer_log; };
       category xfer-out { zone_transfer_log; };
       channel zone_transfer_log {
           file "/var/named/log/transfer.log" versions 10 size 50m;
           print-time yes;
           print-category yes;
           print-severity yes;
           severity info;
        };
   
        ...
   };

   With this example configuration, BIND logs messages related to zone transfers to /var/named/log/transfer.log. BIND creates up to 10 versions of the log file and rotates them if they reach a maximum size of 50 MB.

   The category phrase defines to which channels BIND sends messages of a category.

   The channel phrase defines the destination of log messages including the number of versions, the maximum file size, and the severity level BIND should log to a channel. Additional settings, such as enabling logging the time stamp, category, and severity of an event are optional, but useful for debugging purposes.

2. Create the log directory if it does not exist, and grant write permissions to the named user on this directory:

   # mkdir /var/named/log/
   # chown named:named /var/named/log/
   # chmod 700 /var/named/log/

3. Verify the syntax of the /etc/named.conf file:

   # named-checkconf

   If the command displays no output, the syntax is correct.

4. Restart BIND:

   # systemctl restart named

   If you run BIND in a change-root environment, use the systemctl restart named-chroot command to restart the service.