Ubuntu Manpage: bind8_named2dlf - convert BIND8 named logs into dlf format

NAME

       bind8_named2dlf - convert BIND8 named logs into dlf format

SYNOPSIS

       bind8_named2dlf

DESCRIPTION

       This script converts each line in a BIND8 named log to a dnszone dlf record.  It is tested
       using Bind 8.2 logs.  We're not aware of any changes in the logging format in any Bind 8.*
       version, we expect any bind 8.* log to get processed fine by this script.

       The following lines are recognized:

       ·   approved/denied AXFR requests

       ·   completed zone transfers

       ·   loaded master and slave zones

       ·   denied dynamic DNS updates

DLF format

       The DLF format of the dnszone superservice is

       server
           Name of the DNS server

       time
           Timestamp for the request

       axfr_host
           IP address of the host requesting the AXFR

       axfr_zone
           Name of the zone being requested

       axfr_what
           approved, denied or axfr

       loaded_zone
           Name of the zone just loaded

       loaded_serial
           Serial of the zone just loaded

       loaded_role
           master or slave

       updatedenied_host
           IP address of the host requesting the update

       updatedenied_zone
           Name of the zone being updated

       Due to the nature of the different meanings of the lines in the logfile (not every line
       has both a AXFR-request, loaded a zone and gotten an update request), one or more fields
       can be replaced by a 0 or a -. These fields are automaticly filtered out for the different
       kind of reports.

       Example of DLF lines are:

       AXFR approved
           tim 1026644876 10.10.10.1 algron.com approved - 0 - - -

       update denied
           tim 1026645567 - - - - 0 - 10.in-addr.arpa 10.199.16.218

       master zone loaded
           tim 1026525210 - - - nigelbowen.com.au 2002071301 master - -

EXAMPLES

       To process a log as produced by bind8:

        $ bind8_named2dlf < named-log

       bind8_named2dlf will be rarely used on its own, but is more likely called by
       lr_log2report:

        $ lr_log2report bind8_named < /var/log/named

VERSION

       $Id: bind8_named2dlf.in,v 1.7 2004/10/13 10:17:27 vanbaal Exp $

COPYRIGHT

Redistribution and use in source and binary forms, with or without modification, are
permitted provided that the following conditions are met:

1. Redistributions of source code must retain the above copyright notice, this list of
conditions and the following disclaimer.

2. Redistributions in binary form must reproduce the above copyright notice, this list of
conditions and the following disclaimer in the documentation and/or other materials
provided with the distribution.

3. The name of the copyright holder may not be used to endorse or promote products derived
from this software without specific prior written permission.

THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,
INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF
THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

AUTHOR

       Edwin Groothuis <edwin@mavetju.org>