Understanding logging.

Mark Andrews Mark_Andrews at isc.org
Wed Sep 22 13:40:14 UTC 2004


> >>>>> "Geir" == Geir Wettland <Geir.Wettland at runit.no> writes:
> 
>     Geir> What does the + the - and the E at the end of the lines
>     Geir> mean?  I've started to notice them after I upgraded from
>     Geir> 9.2.x to 9.3.0rc3.
> 
> The + and - indicate whether the RA (Recursion Available) bit was or
> wasn't set in the query. If it's set, the query probably came from a
> name server that is saying it can do recursion and would be happy to
> get a referral response. If it's not set -- indicated by the minus
> sign -- the query probably comes from a stub resolver that expects the
> name server to perform the resolution. EDNS0 queries are indicated by
> the letter E in the logs.
> 

	From the BIND 9.3.0 Adminstators Reference Manual
	under the description of query logging.

The query log entry reports the client's IP address and port number.  The
query name, class and type.  It also reports whether the Recursion Desired
flag was set (+ if set, - if not set), EDNS was in use (E) or if the
query was signed (S).

--
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: Mark_Andrews at isc.org


More information about the bind-users mailing list