Understanding logging.
Mark Andrews
Mark_Andrews at isc.org
Wed Sep 22 13:40:14 UTC 2004
> >>>>> "Geir" == Geir Wettland <Geir.Wettland at runit.no> writes:
>
> Geir> What does the + the - and the E at the end of the lines
> Geir> mean? I've started to notice them after I upgraded from
> Geir> 9.2.x to 9.3.0rc3.
>
> The + and - indicate whether the RA (Recursion Available) bit was or
> wasn't set in the query. If it's set, the query probably came from a
> name server that is saying it can do recursion and would be happy to
> get a referral response. If it's not set -- indicated by the minus
> sign -- the query probably comes from a stub resolver that expects the
> name server to perform the resolution. EDNS0 queries are indicated by
> the letter E in the logs.
>
From the BIND 9.3.0 Adminstators Reference Manual
under the description of query logging.
The query log entry reports the client's IP address and port number. The
query name, class and type. It also reports whether the Recursion Desired
flag was set (+ if set, - if not set), EDNS was in use (E) or if the
query was signed (S).
--
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742 INTERNET: Mark_Andrews at isc.org
More information about the bind-users
mailing list