BIND Queries log to Remote Syslog Server
by CyberIT from LinuxQuestions.org on (#4Z71C)
Hello,
I would like to send BIND query logs to a remote syslog server. Logs are currently stored in a log file on the BIND server.
Code:logging {
...
channel default_file {
file "/var/log/named/default.log";
severity warning;
print-severity yes;
print-category yes;
print-time yes;
};
channel queries_file {
file "/var/log/named/queries.log";
severity dynamic;
print-severity yes;
print-category yes;
print-time yes;
};
...
category default { default_file; };
category queries { queries_file; };
...
};I believe I need to change the "channel queries_file" to something like below but Im not sure how to get my syslog server (rsyslog.conf) to recognize it instead of the local BIND server??
Code:channel queries_file {
syslog daemon;
severity warning;
print-severity yes;
print-category yes;
print-time yes;
};For my BIND servers, Im using Rhel 7.7; BIND 9.11.4-P2-RedHat-9.11.4-9.P2.el7
For my Syslog servers, Im using Rhel 7.7.
I appreciate all help provided. Thanks!


I would like to send BIND query logs to a remote syslog server. Logs are currently stored in a log file on the BIND server.
Code:logging {
...
channel default_file {
file "/var/log/named/default.log";
severity warning;
print-severity yes;
print-category yes;
print-time yes;
};
channel queries_file {
file "/var/log/named/queries.log";
severity dynamic;
print-severity yes;
print-category yes;
print-time yes;
};
...
category default { default_file; };
category queries { queries_file; };
...
};I believe I need to change the "channel queries_file" to something like below but Im not sure how to get my syslog server (rsyslog.conf) to recognize it instead of the local BIND server??
Code:channel queries_file {
syslog daemon;
severity warning;
print-severity yes;
print-category yes;
print-time yes;
};For my BIND servers, Im using Rhel 7.7; BIND 9.11.4-P2-RedHat-9.11.4-9.P2.el7
For my Syslog servers, Im using Rhel 7.7.
I appreciate all help provided. Thanks!