Bind's logs

[Andy Shellam (Mailing Lists)]

Michael Milligan wrote:
> Andy Shellam (Mailing Lists) wrote:
>   
>> Hi Greg,
>>
>> I log all executed queries on my DNS server as follows...
>>     
>
> You seem to imply you have it on all the time...  I hope that's not what
> you're advocating.  It is not a good idea for admins to do that in
> general as this can bring even a moderately busy name server to its
> knees.  Be careful out there.
>   
Yes I do, it's only a light-use server (~100k queries a day), and I've 
not had any speed issues since the box was installed 6 months ago.
Having it on has actually helped spot a couple of viruses on our 
internal clients, in the form of repeated queries to a certain group of 
host addresses that didn't exist.

If it did start to cause problems then I'd happily turn it off, but so 
far it's been more of an advantage than a drawback.

Thanks for the look-out though,

Andy