How to deal with growing BIND9 log files

Forum Moderators: bakedjake

Message Too Old, No Replies

How to deal with growing BIND9 log files

abrodski

7:52 am on Oct 24, 2015 (gmt 0)

My DNS server's logs are the text files that growing too fast and one of them is already over 30 MB in size. I didn't set up the max. file sizes. I would prefer just to manually delete the lines inside the files. Let's say, my log contains entries for the last 10 days.The entries that refer to 9 days I would manually delete and leave there just the last day's entries. Is it something that's not gonna cause any damage to anything, I hope?

bhukkel

12:13 pm on Oct 24, 2015 (gmt 0)

I do not use BIND9 but can you not integrate it with logrotate?

dstiles

6:04 pm on Oct 24, 2015 (gmt 0)

I assume bind is well-patched and the hits you sustain are not malicious, such as dns-based denial-of-service.

robzilla

8:30 pm on Oct 24, 2015 (gmt 0)

30 MB is not too large, but it's certainly good to archive older log entries every once in a while, and as bhukkel says, logrotate can take care of this for you -- in fact, it's probably the single best tool for the job.

abrodski

5:12 am on Oct 25, 2015 (gmt 0)

Thank you all for your replies!
I'm assuming that it's safe to delete manually since you haven't said otherwise. That's first...
Second... That 30 MB quickly got to over 50. It might not sound like much, but it takes time even to open the file.
Third... Yes, there's no alternative, but to learn how to manage logs to keep the situation under control. Something I would do when I'm freer.
What I've done so far... Stopped named, manually deleted most of the content of my 2 BIND log files and started BIND.

robzilla

9:26 am on Oct 25, 2015 (gmt 0)

Logrotate takes care of that for you, without stopping named. It's not technically "safe" to stop named since that stops it from answering all DNS queries that may arrive in the meantime.

Turns out Bind9 also has log rotation built into to it. See [zytrax.com...] ("versions" and "size")

abrodski

4:24 am on Oct 26, 2015 (gmt 0)

Thank you for your reply!
So what can go wrong if for a SHORT period of time (a few minutes) named won't answer the queries?
How it could damage anything in my system (like BIND itself, Postfix or LAMP)?
Though I'm running production server, they're not mission critical. I'm just learning at this point.

robzilla

11:22 am on Oct 26, 2015 (gmt 0)

The client will then try a secondary nameserver (then tertiary, etc), if there is one. Unless none of the nameservers respond to the query, the DNS lookup will only be delayed. Nothing will be "damaged" other than the lookup itself, but it's still probably best to learn proper log rotation while you're at it :-)

abrodski

2:12 pm on Oct 26, 2015 (gmt 0)

O.K. now I understand! Thanks!