<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto">It is documented in the Administrators Reference Manual (ARM). Look for the queries channel in the logging section. See Downloads on the ISC website for the ARM version appropriate for your release. <div><br></div><div>e.g.<br><div><br></div><div><a href="https://downloads.isc.org/isc/bind9/9.20.6/doc/arm/html/reference.html#namedconf-statement-logging">https://downloads.isc.org/isc/bind9/9.20.6/doc/arm/html/reference.html#namedconf-statement-logging</a></div><div><br id="lineBreakAtBeginningOfSignature"><div dir="ltr">-- <div>Mark Andrews</div></div><div dir="ltr"><br><blockquote type="cite">On 4 Mar 2025, at 06:45, Brett Delmage via bind-users <bind-users@lists.isc.org> wrote:<br><br></blockquote></div><blockquote type="cite"><div dir="ltr"><span>On Mon, 3 Mar 2025, Michael Richardson wrote:</span><br><span></span><br><blockquote type="cite"><span>Brett Delmage via bind-users <bind-users@lists.isc.org> wrote:</span><br></blockquote><blockquote type="cite"><span> > Specifically for me now that's the query log including the flags. But it</span><br></blockquote><blockquote type="cite"><span> > could be other log files too at times. I am running DNSSEC and primary,</span><br></blockquote><blockquote type="cite"><span> > secondary, and internal resolving servers so many logs are of interest at</span><br></blockquote><blockquote type="cite"><span> > different times.</span><br></blockquote><blockquote type="cite"><span></span><br></blockquote><blockquote type="cite"><span>If you are having DNSSEC problems, then you may find</span><br></blockquote><blockquote type="cite"><span>https://dnsviz.net/d/brettdelmage.ca/dnssec/</span><br></blockquote><blockquote type="cite"><span></span><br></blockquote><blockquote type="cite"><span>useful. BTW: I don't see anything wrong there.</span><br></blockquote><blockquote type="cite"><span>Are you having problems with others resolving your domain, or problems with</span><br></blockquote><blockquote type="cite"><span>another domain?</span><br></blockquote><span></span><br><span>Thanks. I was actually just trying to debug acme.sh DNS-01 cert generation. Cert gen works fine with the the LE test/staging server but unreliably with the real LE server.</span><br><span></span><br><span>While debugging I realized I was not 100% certain on the flags and other fields in the query log and sought to expand my knowledge. I know the flags field corresponds to flags in the DNS protocol and dig man page, but I'm only guessing the query log's single-character representation, and some other fields.</span><br><span></span><br><span>It seems to me that it would be useful for ISC to have a page explaining the log file formats, if I have simply not found it. I searched this list's archives before posting, too.</span><br><span></span><br><span>(I think the LE server DNS-01 authentication query may not be reaching my BIND server due to some very heavy packet filtering I use. So I was debugging that using multitail on both update.log and query.log to watch the DNS action. acme.sh DNS-01 challenges have worked fine for me for years on various servers so something has changed or I am making a stupid mistake. But that's not BIND-related. Anyone know the best forum for asking an acme.sh question?)</span><br><span></span><br><span>Brett</span><br><span></span><br><span></span><br><span></span><br><span>-- </span><br><span>Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list</span><br><span></span><br><span>ISC funds the development of this software with paid support subscriptions. Contact us at https://www.isc.org/contact/ for more information.</span><br><span></span><br><span></span><br><span>bind-users mailing list</span><br><span>bind-users@lists.isc.org</span><br><span>https://lists.isc.org/mailman/listinfo/bind-users</span><br></div></blockquote></div></div></body></html>