DNS掃盲系列之六:擅用日志排除BIND故障
這么多年來(lái)耳聞目染，發(fā)現網(wǎng)友提出的幾乎99%的問(wèn)題本來(lái)是不需要求助就能解決的，追其根源是不擅于（或不知道）使用軟件本身提供的運行日志來(lái)解決問(wèn)題。本文就BIND服務(wù)器日志簡(jiǎn)要說(shuō)明。這里假設一網(wǎng)友反映“啟動(dòng)named進(jìn)程后配置的域名解析服務(wù)不工作”這一簡(jiǎn)單問(wèn)題說(shuō)明怎么使用named的日志來(lái)解決。
首先了解一個(gè)named啟動(dòng)參數:“-g”，這個(gè)參數可以使named啟動(dòng)過(guò)程的細節展現在面前，自然的哪里的問(wèn)題就一目了然了。
www.2cto.com
[root@test ~]#named -gc /var/named/etc/named.conf
02-Jan-2010 11:05:54.687 starting BIND 9.5.1-P3 -gc /var/named/etc/named.conf
02-Jan-2010 11:05:54.687 found 1 CPU, using 1 worker thread
02-Jan-2010 11:05:54.688 using up to 4096 sockets
02-Jan-2010 11:05:54.697 loading configuration from '/var/named/etc/named.conf'
02-Jan-2010 11:05:54.698 /var/named/etc/named.conf:45: missing ';' before 'key'
02-Jan-2010 11:05:54.698 loading configuration: failure
02-Jan-2010 11:05:54.698 exiting (due to fatal error)
我們看到日志提示在named.conf文件的第45行少寫(xiě)了“；”，好，問(wèn)題找到了排除問(wèn)題就簡(jiǎn)單了。打開(kāi)named.conf把那個(gè)“；”補上。
[root@test ~]##named -gc /var/named/etc/named.conf
02-Jan-2010 11:06:33.807 starting BIND 9.5.1-P3 -gc /var/named/etc/named.conf
02-Jan-2010 11:06:33.807 found 1 CPU, using 1 worker thread
02-Jan-2010 11:06:33.808 using up to 4096 sockets
02-Jan-2010 11:06:33.817 loading configuration from '/var/named/etc/named.conf'
02-Jan-2010 11:06:33.819 using default UDP/IPv4 port range: [49152, 65535]
02-Jan-2010 11:06:33.819 using default UDP/IPv6 port range: [49152, 65535]
02-Jan-2010 11:06:33.821 no IPv6 interfaces found
02-Jan-2010 11:06:33.821 listening on IPv4 interface re0, 192.168.0.20#53
02-Jan-2010 11:06:33.822 listening on IPv4 interface re0, 192.168.0.10#53
02-Jan-2010 11:06:33.823 listening on IPv4 interface lo0, 127.0.0.1#53
02-Jan-2010 11:06:33.832 command channel listening on 127.0.0.1#953
02-Jan-2010 11:06:33.833 ignoring config file logging statement due to -g option
02-Jan-2010 11:06:33.840 zone 127.IN-ADDR.ARPA/IN: loaded serial 1
02-Jan-2010 11:06:33.840 zone test.com/IN: loaded serial 912200620
02-Jan-2010 11:06:33.841 running
02-Jan-2010 11:06:33.841 zone test.com/IN: sending notifies (serial 912200620)
問(wèn)題排除。上面方法適用于下列情形：
1. 安裝BIND后調試named,看看有沒(méi)有問(wèn)題。
2. 出現致命錯誤named中斷運行了。
3. 非重要DNS服務(wù)器，可以停機檢查的。
對于正在運行的DNS服務(wù)器，不想讓其停止運行，這時(shí)候要發(fā)現潛在問(wèn)題再使用上述方法就不太適宜了。這就要求我們可以讓named把日志記錄到專(zhuān)門(mén)的文件內，供我們隨時(shí)查詢(xún)。具體操作是在named.conf配置log:
logging {
channel warning
{ file "log/named.log" versions 3 size 2048k;
severity warning;
print-category yes;
print-severity yes;
print-time yes;
};
channel query
{ file "log/query.log" versions 3 size 2048k;
severity info;
print-category yes;
print-severity yes;
print-time yes;
};
category default { warning; };
category queries { query; };
};
www.2cto.com
這里我們讓named把named運行日志和日常查詢(xún)日志分別記錄到named.log和query.log文件內。
最后測試一下解析是否正常了：
[root@test ~]#dig @localhost www.test.com
; <<>> DiG 9.5.1-P3 <<>> @localhost www.test.com
; (1 server found)
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 45637
;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 3, ADDITIONAL: 3
;; WARNING: recursion requested but not available
;; QUESTION SECTION:
;www.test.com. IN A
;; ANSWER SECTION:
www.test.com. 3600 IN A 12.1.1.1
;; AUTHORITY SECTION:
test.com. 172800 IN NS ns2.test.com.
test.com. 172800 IN NS ns1.test.com.
test.com. 172800 IN NS ns3.test.com.
;; ADDITIONAL SECTION:
ns1.test.com. 3600 IN A 12.2.2.2
ns2.test.com. 3600 IN A 12.3.3.3
ns3.test.com. 3600 IN A 12.4.4.4
;; Query time: 29 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Sat Jan 2 11:48:03 2010
;; MSG SIZE rcvd: 148
由于是針對初級用戶(hù)，更深相關(guān)細節不再贅述。
