<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang="EN-US" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal">You don’t mention your query rates. By chance is syslog rate limiting the messages sent by querylog channel?
<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><b><span style="font-size:12.0pt;color:black">From:
</span></b><span style="font-size:12.0pt;color:black">bind-users <bind-users-bounces@lists.isc.org> on behalf of Speagle, Andy via bind-users <bind-users@lists.isc.org><br>
</span>Hey Folks,<br>
<br>
I'm seeing something really strange with 9.16.26 ... we're getting like<br>
10min gaps in the logs sent to syslog... the server seems to work just<br>
fine... it just stops logging for long periods of time. We're using<br>
rsyslog on el8 ...<br>
<br>
Our logging looks like this:<br>
<br>
logging {<br>
channel dns_syslog {<br>
syslog local0;<br>
severity info;<br>
};<br>
<br>
category default { dns_syslog; };<br>
<br>
// Don't log denied queries (after closing recursive resolution).<br>
// In spite of the title, the security category is *only*<br>
// approval and denial of requests.<br>
category security { null; };<br>
<br>
// Don't log format errors from lame servers.<br>
category lame-servers { null; };<br>
<br>
// Don't log format errors of other types.<br>
category resolver { null; };<br>
<br>
// Log queries of records for which we're authoritative.<br>
// They don't seem to be filterable in named so they're being<br>
filtered<br>
// in syslog-ng.<br>
channel querylog {<br>
syslog local6;<br>
severity debug 3;<br>
print-category yes;<br>
print-time yes;<br>
};<br>
<br>
category queries { querylog; };<br>
};<br>
<br>
This all looks pretty standard... anyone else seen this?<br>
<br>
Thanks,<br>
<br>
Andy<br>
<br>
<o:p></o:p></p>
</div>
</div>
<br>
<p style="font-family:Calibri;font-size:8pt;color:#000000;margin:15pt;" align="Left">
Sensitivity: Internal<br>
</p>
</body>
</html>