How can I retrieve the details that makes up the statistics?

[Chris Buxton]

On Tue, 2008-12-02 at 11:57 -0800, JINMEI Tatuya / 神明達哉 wrote:
> At Mon, 10 Nov 2008 09:54:19 -0800,
> Chris Buxton <cbuxton at menandmice.com> wrote:
> 
> > A logging category that logged not just incoming queries, but also  
> > outgoing queries, and also the responses sent/received to these  
> > queries, would be really handy. It doesn't need to log the whole  
> > packet (except at some debug level), but just something along the  
> > lines of the current logging category. For responses, also log the  
> > type of response: positive answer, nxrrset (or whatever you want to  
> > call this), nxdomain, referral, or error (with type).
> > 
> > This category could either log all of this at info level, or else log  
> > incoming queries at level notice and all other traffic at level  
> > notice. Or even log incoming queries at level info and all other  
> > traffic at debug level 1 (to retain current behavior for non-debug  
> > levels), and then start logging full packet contents (i.e. what we see  
> > in default dig output) at higher debug levels.
> > 
> > I see this as a replacement for the current queries logging category,  
> > not an addition to it.
> 
> Thanks for the suggestions.  These generally seem to me to make sense
> (although I'd rather use a separate log category for outgoing queries
> and incoming responses).

What about outgoing responses?

I remember what a shock it was when I switched from QuickDNS Server
(classic Mac OS, long, long ago) to BIND that I couldn't see anything
more than incoming queries. QuickDNS Server could log all queries and
responses going in and out of the server.

If you create a new logging category for this, please make it easy for
the administrator to put all of these messages into a single, separate
log file without anything else. There should be a severity level
(possibly info) for the channel that logs the existence of each message
and a short summary, similar to today's queries category, and then a
debug severity level that logs the contents of each message.

You could call the category "messages". It could log the content of all
messages, including queries, updates, notifies, zone transfer requests,
and the responses to all of these.

Chris Buxton
Professional Services
Men & Mice