<div dir="ltr"><div>I don't believe there is any logging category for this, even when zones are enabled for Dynamic Update, in which case the versioning is done automatically. There used to be a "journalprint" utility that one could run against the .jnl files to show the update history. But, even if the journaling mechanism and the "journalprint" utility still exist as I remember it, it would most likely only work for Dynamic-Update-enabled zones. I don't believe .jnl files are created for non-Dynamic-Update-enabled zones, although I could be wrong on that -- maybe named synthesizes .jnl files for purposes of IXFR (???).</div><div><br></div>If you're doing manual editing, I assume you have some mechanism to reload the zone after each edit, presumably a script of some sort. The best suggestion I have, short of evolving your solution significantly, is to add a "diff against previous version" + "make a copy of the current version of the file" sequence into that script, to capture the deltas, along with a decision on how much history you want to keep, and perhaps a cron script to purge the stale versions so the repository doesn't grow without bound. (The maintenance/garbage-collection function could theoretically be integrated into the main diff logic).<div><br></div><div>The next evolution might be to use a version-control system. The next evolution beyond that might be a web interface with a dynamic-update backend (which still serves some of our use cases) or a "panel" package (assuming it has sufficient logging/auditing for your needs) or an enterprise-strength DNS management solution (e.g. Infoblox, which we also use).</div><div><br></div><div> - Kevin</div></div><br><div class="gmail_quote"><div dir="ltr">On Fri, Jan 11, 2019 at 9:50 AM Daniel Dawalibi <<a href="mailto:daniel.dawalibi@idm.net.lb" target="_blank">daniel.dawalibi@idm.net.lb</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Hello <br>
<br>
We edit our zones manually (not through panel interface), is it possible to<br>
log DNS updates in this case?<br>
Logging is already enabled but we are unable to track the updated zones in<br>
the logs<br>
The enabled category on the authoritative Master DNS server are "xfer-in",<br>
"security", "network", "default", "config", "queries" and "update".<br>
<br>
How can we enable the journal files in our case? Is there any impact on the<br>
DNS performance?<br>
<br>
<br>
Regards<br>
Daniel <br>
<br>
-----Original Message-----<br>
From: Tony Finch [mailto:<a href="mailto:dot@dotat.at" target="_blank">dot@dotat.at</a>] <br>
Sent: Tuesday, January 8, 2019 2:05 PM<br>
To: Daniel Dawalibi<br>
Cc: <a href="mailto:bind-users@lists.isc.org" target="_blank">bind-users@lists.isc.org</a><br>
Subject: Re: BIND DNS Enable audit logs - Authoritative<br>
Importance: High<br>
<br>
Daniel Dawalibi <<a href="mailto:daniel.dawalibi@idm.net.lb" target="_blank">daniel.dawalibi@idm.net.lb</a>> wrote:<br>
><br>
> Is it possible to enable the audit logs on BIND DNS so we can track <br>
> changes performed on the DNS records level (Add/Delete/Modify A,MX,NS,.<br>
records)?<br>
<br>
You can get that by default, depending on how the changes were performed.<br>
<br>
If you use `nsupdate` or some other dynamic DNS UPDATE client, `named` will<br>
log changes like this ...<br>
<br>
08-Jan-2019 11:55:09.826 update: info:<br>
client @0x55b747f47ec0 ::1#5685/key local-ddns:<br>
updating zone '<a href="http://private.cam.ac.uk/IN" rel="noreferrer" target="_blank">private.cam.ac.uk/IN</a>':<br>
adding an RR at '<a href="http://private.cam.ac.uk" rel="noreferrer" target="_blank">private.cam.ac.uk</a>' SOA <a href="http://primary.dns.cam.ac.uk" rel="noreferrer" target="_blank">primary.dns.cam.ac.uk</a>.<br>
<a href="http://hostmaster.cam.ac.uk" rel="noreferrer" target="_blank">hostmaster.cam.ac.uk</a>. 1546948509 1800 900 604800 3600<br>
08-Jan-2019 11:55:09.826 update: info:<br>
client @0x55b747f47ec0 ::1#5685/key local-ddns:<br>
updating zone '<a href="http://private.cam.ac.uk/IN" rel="noreferrer" target="_blank">private.cam.ac.uk/IN</a>':<br>
adding an RR at '<a href="http://QQQQ.lcil.private.cam.ac.uk" rel="noreferrer" target="_blank">QQQQ.lcil.private.cam.ac.uk</a>' A 172.22.QQ.QQ<br>
<br>
The changes are also recorded in the zone's journal, which you can extract<br>
like:<br>
<br>
$ named-journalprint /home/named/zone/private.cam.ac.uk.jnl<br>
[...]<br>
del <a href="http://private.cam.ac.uk" rel="noreferrer" target="_blank">private.cam.ac.uk</a>. 3600 IN SOA <a href="http://primary.dns.cam.ac.uk" rel="noreferrer" target="_blank">primary.dns.cam.ac.uk</a>.<br>
<a href="http://hostmaster.cam.ac.uk" rel="noreferrer" target="_blank">hostmaster.cam.ac.uk</a>. 1546944908 1800 900 604800 3600<br>
add <a href="http://private.cam.ac.uk" rel="noreferrer" target="_blank">private.cam.ac.uk</a>. 3600 IN SOA <a href="http://primary.dns.cam.ac.uk" rel="noreferrer" target="_blank">primary.dns.cam.ac.uk</a>.<br>
<a href="http://hostmaster.cam.ac.uk" rel="noreferrer" target="_blank">hostmaster.cam.ac.uk</a>. 1546948509 1800 900 604800 3600<br>
add <a href="http://QQQQ.lcil.private.cam.ac.uk" rel="noreferrer" target="_blank">QQQQ.lcil.private.cam.ac.uk</a>. 3600 IN A 172.22.QQ.QQ<br>
<br>
You might want to use the `ixfr-from-differences` and `max-journal-size`<br>
options if you care about preserving journal contents.<br>
<br>
Alternatively, keep your zone contents in `git` or a database that keeps an<br>
audit log :-)<br>
<br>
Tony.<br>
--<br>
f.anthony.n.finch <<a href="mailto:dot@dotat.at" target="_blank">dot@dotat.at</a>> <a href="http://dotat.at/" rel="noreferrer" target="_blank">http://dotat.at/</a> Mull of Galloway to Mull<br>
of Kintyre including the Firth of Clyde and North<br>
Channel: Northwesterly 4 or 5, occasionally 6 at first in the North Channel,<br>
becoming variable 3 or less. Moderate, becoming smooth or slight. Occasional<br>
rain later. Good, occasionally moderate later.<br>
<br>
_______________________________________________<br>
Please visit <a href="https://lists.isc.org/mailman/listinfo/bind-users" rel="noreferrer" target="_blank">https://lists.isc.org/mailman/listinfo/bind-users</a> to unsubscribe from this list<br>
<br>
bind-users mailing list<br>
<a href="mailto:bind-users@lists.isc.org" target="_blank">bind-users@lists.isc.org</a><br>
<a href="https://lists.isc.org/mailman/listinfo/bind-users" rel="noreferrer" target="_blank">https://lists.isc.org/mailman/listinfo/bind-users</a><br>
</blockquote></div>