Score:0

How to prevent BIND logging queries matching a regular expression?

cn flag

I am currently running BIND named on my Internet facing servers to respond to authoritative query requests for my domains. So, I have configured /etc/bind/named.conf.local as follows to log all queries coming to my DNS servers:

[...]

logging {
        channel query.log {
                file "/var/log/named/query.log" versions 10 size 10m;
                severity debug 3;
                print-time yes;
        };
        category config { default_syslog; };
        category queries { query.log; };
        category default { null; };
};

Recently my servers started logging many queries coming from IP addresses around the world (see the DNS amplification attacks explained at https://www.linuxquestions.org/questions/linux-newbie-8/there-are-many-query-this-website-on-my-dns-server-4175676097/). I do not want to use fail2ban to prevent those IP addresses from making queries to my DNS servers, simply because there are too many IP addresses (more than 500 IPs where collected in 24 hours, for example) and it seems unnecessary to fill my iptables with such unneeded entries.

I just want named not to log queries matching something like this to the query.log file (because my log file starts filling and rotating very rapidly):

client .* (pizzaseo.com): query: pizzaseo.com IN RRSIG .*

Is there a configuration in named that will allow me to filter out some query entries before being logged to query.log?

I considered to use "named pipes" to pass all the output to query.log through a grep command. But, this may have an adverse effect on the BIND daemon if the grep command dies somehow and the "named pipe" becomes full.

Note that I need to log all entries (except this pizzaseo thing) for some other purposes/needs.

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.