Aw: No "notify" category debug log entries anymore with Bind 9.11.3
OK I fixed the root issue by introducing a forwarding zone for example.com to
get the resolution for ns{1,2,3}.example.com from internet nameservers:
zone "example.com" IN {
type forward;
forwarders { 1.1.1.1; 8.8.8.8; };
};
Now, the notification can start at all, but then the notifies fail as expected
and the notify debug log messages appear.
Issue solved, but it would be better, if there had been a log message like e.g.
"Cannot resolve addresses of to-be-notified nameservers, notification
impossible.".
> Gesendet: Mittwoch, 05. Januar 2022 um 16:34 Uhr
> Von: "Hildegard Meier"
> An: "Hildegard Meier"
> Cc: bind-users@lists.isc.org
> Betreff: Aw: No "notify" category debug log entries anymore with Bind 9.11.3
>
> Additional difference between the old Bind 9.8.1 Host and the new Bind 9.11.3
> Host is that the new (test) Host cannot (and shall not) reach the external
> DNS servers that are in the SOA records of the DNS zones we host as "hidden
> primary" and notify to the external bind hosts. (because it is only for test)
>
> It looks like because the new host cannot reach the external nameservers,
> also the address records of the nameservers of our hosted zones (in the SOA)
> cannot be resolved, to which the notifies go to.
>
> So if I do a "rndc norify" to force a notification of the external
> nameservers, their IP addresses are unknown to Bind, and therefore nothing
> can be done.
>
> So this is a logging issue, because there should be a message I think of
> severity "info" at least, if a notify cannot be started because unknown IP
> addresses of the nameservers to be notified.
> Instead as I have written, is just logged
> > 29-Dec-2021 12:00:33.475 notify: info: zone example.com/IN: sending
> > notifies (serial 2021021001)
>
> and nothing more. This is insufficient, even more when in debug log level.
>
> Is there a way to exclude
> ns1.example.com
> ns2.example.com
> ns3.example.com
>
> from bind recursive resolving but give bind static A records for that names,
> or alternatively tell bind to look in /etc/hosts for the IP addresses?
> Then I would expect the test bind host to really start the notifies to the IP
> addresses and then the notify failure messages would appear.
>
___
Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe
from this list
ISC funds the development of this software with paid support subscriptions.
Contact us at https://www.isc.org/contact/ for more information.
bind-users mailing list
bind-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users
Aw: No "notify" category debug log entries anymore with Bind 9.11.3
Additional difference between the old Bind 9.8.1 Host and the new Bind 9.11.3
Host is that the new (test) Host cannot (and shall not) reach the external DNS
servers that are in the SOA records of the DNS zones we host as "hidden
primary" and notify to the external bind hosts. (because it is only for test)
It looks like because the new host cannot reach the external nameservers, also
the address records of the nameservers of our hosted zones (in the SOA) cannot
be resolved, to which the notifies go to.
So if I do a "rndc norify" to force a notification of the external nameservers,
their IP addresses are unknown to Bind, and therefore nothing can be done.
So this is a logging issue, because there should be a message I think of
severity "info" at least, if a notify cannot be started because unknown IP
addresses of the nameservers to be notified.
Instead as I have written, is just logged
> 29-Dec-2021 12:00:33.475 notify: info: zone example.com/IN: sending notifies
> (serial 2021021001)
and nothing more. This is insufficient, even more when in debug log level.
Is there a way to exclude
ns1.example.com
ns2.example.com
ns3.example.com
from bind recursive resolving but give bind static A records for that names, or
alternatively tell bind to look in /etc/hosts for the IP addresses?
Then I would expect the test bind host to really start the notifies to the IP
addresses and then the notify failure messages would appear.
> Gesendet: Mittwoch, 05. Januar 2022 um 15:08 Uhr
> Von: "Hildegard Meier"
> An: "Hildegard Meier"
> Cc: bind-users@lists.isc.org
> Betreff: Aw: No "notify" category debug log entries anymore with Bind 9.11.3
>
> Please see my comments between the citates.
>
> > Betreff: No "notify" category debug log entries anymore with Bind 9.11.3
> >
> > On old server with Ubuntu 12 and Bind 9.8.1
> > I got the following "notify" category log entries as expected (domain names
> > and IP addresses redacted):
> >
> > 27-Dec-2021 12:58:51.786 notify: debug 3: zone example.com/IN: sending
> > notify to 1.2.3.4#53
> > 27-Dec-2021 12:58:51.816 notify: debug 3: zone example.com/IN: notify
> > response from 1.2.3.4#53: NOERROR
>
> > With new server Ubuntu 18 and Bind 9.11.3
> > there are no "notify" category debug log entries anymore. The log does only
> > contain entries of severity "info", e.g.
> >
> > 29-Dec-2021 12:00:33.475 notify: info: zone example.com/IN: sending
> > notifies (serial 2021021001)
>
> Looks to me like this is the code where the above "notify response..." debug
> log message I am missing with Bind 9.11.3 is created:
>
> https://github.com/isc-projects/bind9/blob/v9_11_3_patch/lib/dns/zone.c
>
> 13862 if (result == ISC_R_SUCCESS)
> 13863 notify_log(notify->zone, ISC_LOG_DEBUG(3),
> 13864 "notify response from %s: %.*s",
> 13865 addrbuf, (int)buf.used, rcode);
> 13866 else
> 13867 notify_log(notify->zone, ISC_LOG_DEBUG(2),
> 13868 "notify to %s failed: %s", addrbuf,
> 13869 dns_result_totext(result));
>
> So the code seems to be there, with debug level 3 and 2, and either if the
> notify was success or failed (the second case of failure I expect because of
> firewall restriction) there should be an according debug log message.
>
> I guess I have a simple logging config error. Any idea why I do not see the
> notify debug log messages?
>
> Can somebody please try to reproduce with Bind 9.11.3 ?
>
> Why did I see the debug log messages with the same config in Bind 9.8.1 ?
>
>
> > Log config in /etc/bind/named.conf.options with Bind 9.11.3 is exactly the
> > same as on the old server with Bind 9.8.1:
> >
> > logging {
> >
> > channel transfer_logfile {
> > file "/var/log/named/transfer.log" versions 7 size 10m;
> > severity debug 6;
> > print-time yes;
> > print-category yes;
> > print-severity yes;
> > };
> >
> > category notify { transfer_logfile; };
> > };
> >
> > I tested with "severity debug 16" but that did not help.
> > I tested with "severity notice", that lead to the "info" log entries to
> > disappear, so there is just nothing logged anymore for "notify" category,
> > as expected.
> >
> > I also run "rndc trace" six times, so in named.log was logged "general:
> > info: debug level is now 6" and did a zone reload, but again, no "notify"
> > debug log entries.
> >
> > I also tested with "severity debug 6" in the defaul
Aw: No "notify" category debug log entries anymore with Bind 9.11.3
Please see my comments between the citates.
> Betreff: No "notify" category debug log entries anymore with Bind 9.11.3
>
> On old server with Ubuntu 12 and Bind 9.8.1
> I got the following "notify" category log entries as expected (domain names
> and IP addresses redacted):
>
> 27-Dec-2021 12:58:51.786 notify: debug 3: zone example.com/IN: sending notify
> to 1.2.3.4#53
> 27-Dec-2021 12:58:51.816 notify: debug 3: zone example.com/IN: notify
> response from 1.2.3.4#53: NOERROR
> With new server Ubuntu 18 and Bind 9.11.3
> there are no "notify" category debug log entries anymore. The log does only
> contain entries of severity "info", e.g.
>
> 29-Dec-2021 12:00:33.475 notify: info: zone example.com/IN: sending notifies
> (serial 2021021001)
Looks to me like this is the code where the above "notify response..." debug
log message I am missing with Bind 9.11.3 is created:
https://github.com/isc-projects/bind9/blob/v9_11_3_patch/lib/dns/zone.c
13862 if (result == ISC_R_SUCCESS)
13863 notify_log(notify->zone, ISC_LOG_DEBUG(3),
13864 "notify response from %s: %.*s",
13865 addrbuf, (int)buf.used, rcode);
13866 else
13867 notify_log(notify->zone, ISC_LOG_DEBUG(2),
13868 "notify to %s failed: %s", addrbuf,
13869 dns_result_totext(result));
So the code seems to be there, with debug level 3 and 2, and either if the
notify was success or failed (the second case of failure I expect because of
firewall restriction) there should be an according debug log message.
I guess I have a simple logging config error. Any idea why I do not see the
notify debug log messages?
Can somebody please try to reproduce with Bind 9.11.3 ?
Why did I see the debug log messages with the same config in Bind 9.8.1 ?
> Log config in /etc/bind/named.conf.options with Bind 9.11.3 is exactly the
> same as on the old server with Bind 9.8.1:
>
> logging {
>
> channel transfer_logfile {
> file "/var/log/named/transfer.log" versions 7 size 10m;
> severity debug 6;
> print-time yes;
> print-category yes;
> print-severity yes;
> };
>
> category notify { transfer_logfile; };
> };
>
> I tested with "severity debug 16" but that did not help.
> I tested with "severity notice", that lead to the "info" log entries to
> disappear, so there is just nothing logged anymore for "notify" category, as
> expected.
>
> I also run "rndc trace" six times, so in named.log was logged "general: info:
> debug level is now 6" and did a zone reload, but again, no "notify" debug log
> entries.
>
> I also tested with "severity debug 6" in the default log channel, that lead
> to debug log entries for categories like "database" etc., so debug log is
> generally working.
>
> How can I get the log entries "sending notify to ..." and "notify response
> from ..." back again in the "notify" category log?
___
Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe
from this list
ISC funds the development of this software with paid support subscriptions.
Contact us at https://www.isc.org/contact/ for more information.
bind-users mailing list
bind-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users
No "notify" category debug log entries anymore with Bind 9.11.3
On old server with Ubuntu 12 and Bind 9.8.1
I got the following "notify" category log entries as expected (domain names and
IP addresses redacted):
27-Dec-2021 12:58:51.786 notify: debug 3: zone example.com/IN: sending notify
to 1.2.3.4#53
27-Dec-2021 12:58:51.816 notify: debug 3: zone example.com/IN: notify response
from 1.2.3.4#53: NOERROR
Log config in /etc/bind/named.conf.options:
logging {
channel transfer_logfile {
file "/var/log/named/transfer.log" versions 7 size 10m;
severity debug 6;
print-time yes;
print-category yes;
print-severity yes;
};
category notify { transfer_logfile; };
};
With new server Ubuntu 18 and Bind 9.11.3
there are no "notify" category debug log entries anymore. The log does only
contain entries of severity "info", e.g.
29-Dec-2021 12:00:33.475 notify: info: zone example.com/IN: sending notifies
(serial 2021021001)
Log config in /etc/bind/named.conf.options with Bind 9.11.3 is exactly the same
as on the old server with Bind 9.8.1:
logging {
channel transfer_logfile {
file "/var/log/named/transfer.log" versions 7 size 10m;
severity debug 6;
print-time yes;
print-category yes;
print-severity yes;
};
category notify { transfer_logfile; };
};
I tested with "severity debug 16" but that did not help.
I tested with "severity notice", that lead to the "info" log entries to
disappear, so there is just nothing logged anymore for "notify" category, as
expected.
I also run "rndc trace" six times, so in named.log was logged "general: info:
debug level is now 6" and did a zone reload, but again, no "notify" debug log
entries.
I also tested with "severity debug 6" in the default log channel, that lead to
debug log entries for categories like "database" etc., so debug log is
generally working.
How can I get the log entries "sending notify to ..." and "notify response from
..." back again in the "notify" category log?
Thanks and Best regards,
Hildegard
___
Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe
from this list
ISC funds the development of this software with paid support subscriptions.
Contact us at https://www.isc.org/contact/ for more information.
bind-users mailing list
bind-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users
