Logrotate for bind9

[Blason R]

Hi There,

I am not getting appropriate results for my custom daily logrorate for bind9 logs on Ubuntu.

Can someone please help me with the settings which would include below   stuff

1. Should rotate daily
2. Compress
3. create new file
4. keep last 180 entries

Do I need stop bind9 while logs are being rotated? What is the correct procedure to start logs in new file?

[Anand Buddhdev]

On 04/07/2018 15:50, Blason R wrote:

> Hi There,
>
> I am not getting appropriate results for my custom daily logrorate for
> bind9 logs on Ubuntu.

It's more useful if you show us your logrotate snippet, so we can point
out what is wrong with it.

> Can someone please help me with the settings which would include below
> stuff
>
>

> 1. Should rotate daily

daily

> 2. Compress

compress

> 3. create new file

Usually not needed, because BIND creates the log file itself.

> 4. keep last 180 entries

rotate 180

> Do I need stop bind9 while logs are being rotated? What is the correct
> procedure to start logs in new file?

You don't have to stop BIND to rotate log files. Instead, you just run
"rndc reconfig" and that causes BIND to reopen its log files. If it
finds that the files have been moved (by logrotate) it will create new
log files.

Anand

[Tom]

...or you use "copytruncate", so the file will be copied and the other
stuff (compress, rotate 180, etc..) and then truncated, so BIND has
still the same filedescriptors open, but the logfile is rotated :-).
This way, you don't need to "rndc reconfig".
Kind regards,
Tom


>
> Anand
> _______________________________________________
> Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list
>
> bind-users mailing list
> bind-...@lists.isc.org
> https://lists.isc.org/mailman/listinfo/bind-users
>

[Anand Buddhdev]

On 04/07/2018 17:43, Tom wrote:

Hi Tom,

> ...or you use "copytruncate", so the file will be copied and the other
> stuff (compress, rotate 180, etc..) and then truncated, so BIND has
> still the same filedescriptors open, but the logfile is rotated :-).
> This way, you don't need to "rndc reconfig".

Sorry, but this is not good advice, and I strongly urge everyone not to
follow it.

Copying a file takes a finite amount of time, so the copy may not have
all the latest logs, and those are lost when the original is truncated.
The bigger the log file, the higher the chance of losing log messages.

The logrotate man page also notes this possibility of losing log
messages, and this option should only be used as a last resort, where
there's no way to tell a program to reopen its log file. BIND has no
such limitation, and so "rndc reconfig" is the right way to handle
reopening its log file.

Regards,
Anand

[Blason R]

What exactly are those? Well what I wated to achieve here is to rotate the logs daily and start new file; then compress

On Thu, Jul 5, 2018 at 6:21 AM Rohan Henry <bic...@gmail.com> wrote:

Why not use Bind logging option?

On Jul 4, 2018 8:51 AM, "Blason R" <blas...@gmail.com> wrote:

Hi There,

I am not getting appropriate results for my custom daily logrorate for bind9 logs on Ubuntu.

Can someone please help me with the settings which would include below   stuff

1. Should rotate daily
2. Compress
3. create new file
4. keep last 180 entries

Do I need stop bind9 while logs are being rotated? What is the correct procedure to start logs in new file?

[Browne, Stuart]

How about a clear, direct example of using external service 'logrotate' (this is from one of my redhat systems, but the same concept applies to Ubuntu/Debian):

 

[be...@dns-nomnom1.den ~]$ cat /etc/logrotate.d/named

/var/log/named/*.log {

  compress

  create 0644 named named

  daily

  dateext

  missingok

  notifempty

  rotate 30

  sharedscripts

  postrotate

    /usr/sbin/rndc reconfig > /dev/null 2>/dev/null || true

  endscript

}

 

We put our logs in the custom location of '/var/log/named/'; if you put them somewhere else, you'll need to change that. The other settings are direct references to Anand's email. Finally, you'll want to change the 30 to 180 to keep 180 different days worth of logs.

 

BIND internally doesn't have the concept based rotation, only size-based rotation. In order to achieve per-day logs, you'll need to use the external tool 'logrotate' (or similar) for your rotation. If you do that, you'll want to disable BIND's rotation in the logs configuration (if you're using that currently), so not this:

 

logging {

        channel ns_log {

                file "/var/log/named/named.log" versions 3 size 256M;

                severity dynamic;

                print-time yes;

                print-severity yes;

                print-category yes;

        };

...

        category default { ns_log; };

        category general { ns_log; };

        category config { ns_log; };

};

 

But this:

 

logging {

        channel ns_log {

                file "/var/log/named/named.log";

                severity dynamic;

                print-time yes;

                print-severity yes;

                print-category yes;

        };

...

        category default { ns_log; };

        category general { ns_log; };

        category config { ns_log; };

};

 

Hope this clarifies the idea a little for you.

 

Stuart

[Blason R]

Corrext I needed a settings like this; I was trying mulitple options but wasnt working. Let me try this!!

Thanks for providing the same.