{"id":4344,"date":"2022-01-14T15:37:57","date_gmt":"2022-01-14T21:37:57","guid":{"rendered":"https:\/\/www.incredigeek.com\/home\/?p=4344"},"modified":"2022-01-14T15:38:26","modified_gmt":"2022-01-14T21:38:26","slug":"enable-syslog-for-powerdns-recursor","status":"publish","type":"post","link":"https:\/\/www.incredigeek.com\/home\/enable-syslog-for-powerdns-recursor\/","title":{"rendered":"Enable Syslog for PowerDNS Recursor"},"content":{"rendered":"\n

<\/p>\n\n\n\n

  1. Enable Logging in PowerDNS Recursor Config<\/li>
  2. Edit Systemd Unit File for PowerDNS to Allow Syslog<\/li>
  3. Enable Logging in rsyslog Config File<\/li><\/ol>\n\n\n\n

    The following links were helpful in setting things up.<\/p>\n\n\n\n

    https:\/\/doc.powerdns.com\/recursor\/running.html<\/a>
    https:\/\/www.reddit.com\/r\/linuxadmin\/comments\/9lc4jl\/logging_queries_in_pdnsrecursor\/<\/a><\/p>\n\n\n\n

    Enable logging in PowerDNS Recursor Config <\/h2>\n\n\n\n

    First we need to find the line that says “disable-syslog” and uncomment\/change it to <\/p>\n\n\n\n

    disable-syslog=no<\/pre>\n\n\n\n
    Next find the line that says “quiet” and uncomment\/change it to <\/p>\n\n\n\n
    quiet=no<\/pre>\n\n\n\n
    Some other lines you may want to check and change<\/p>\n\n\n\n
    logging-facality=1
    loglevel=6<\/pre>\n\n\n\n
     <\/p>\n\n\n\n
    Edit Systemd Unit File for PowerDNS to allow Syslog <\/h2>\n\n\n\n
    Next we need to modify the Systemd unit file to allow PowerDNS Recursor to log to syslog.<\/p>\n\n\n\n
    systemctl edit --full pdns-recursor.service<\/pre>\n\n\n\n
    On the ExecStart Line, remove the part that says<\/p>\n\n\n\n
    --disable-syslog<\/pre>\n\n\n\n
    The resulting line should look something like<\/p>\n\n\n\n
    [Service]
    ExecStart=\/usr\/sbin\/pdns_recursor --socket-dir=%t\/pdns-recursor --socket-dir=%t\/pdns-recursor --daemon=no --write-pid=no --log-timestamp=no<\/pre>\n\n\n\n
    Save the file.<\/p>\n\n\n\n
     <\/p>\n\n\n\n
    Enable Logging in rsyslog Config File <\/h2>\n\n\n\n
    Edit the rsyslog file <\/p>\n\n\n\n
    sudo vim \/etc\/rsyslog.conf<\/pre>\n\n\n\n
    Add the following line<\/p>\n\n\n\n
    local1.*        \/var\/log\/pdns_recursor.log<\/pre>\n\n\n\n
    This should now log all of the PowerDNS Recursor log info to “\/var\/log\/pdns_recursor.log”<\/p>\n\n\n\n
    Restart the rsyslog and PowerDNS Recursor service<\/p>\n\n\n\n
    sudo systemctl restart rsyslog\nsudo systemctl restart pdns-recursor<\/pre>\n\n\n\n
    You should now see DNS request in the log file.<\/p>\n\n\n\n
    tail \/var\/log\/pdns_recursor.log<\/pre>\n\n\n\n
    They should also show up in the “\/var\/log\/messages” <\/p>\n\n\n\n
    <\/p>\n","protected":false},"excerpt":{"rendered":"
    Enable Logging in PowerDNS Recursor Config Edit Systemd Unit File for PowerDNS to Allow Syslog Enable Logging in rsyslog Config File The following links were helpful in setting things up. https:\/\/doc.powerdns.com\/recursor\/running.htmlhttps:\/\/www.reddit.com\/r\/linuxadmin\/comments\/9lc4jl\/logging_queries_in_pdnsrecursor\/ Enable logging in PowerDNS Recursor Config First we need … Continue reading →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[23,46,3],"tags":[17,1255,277,7,234,1250,1279,1278,1280],"class_list":["post-4344","post","type-post","status-publish","format-standard","hentry","category-centos-linux","category-dns","category-linux","tag-centos","tag-centos-8","tag-dns","tag-linux-2","tag-log","tag-logging","tag-pdns","tag-powerdns","tag-recursor"],"_links":{"self":[{"href":"https:\/\/www.incredigeek.com\/home\/wp-json\/wp\/v2\/posts\/4344","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.incredigeek.com\/home\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.incredigeek.com\/home\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.incredigeek.com\/home\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.incredigeek.com\/home\/wp-json\/wp\/v2\/comments?post=4344"}],"version-history":[{"count":4,"href":"https:\/\/www.incredigeek.com\/home\/wp-json\/wp\/v2\/posts\/4344\/revisions"}],"predecessor-version":[{"id":4349,"href":"https:\/\/www.incredigeek.com\/home\/wp-json\/wp\/v2\/posts\/4344\/revisions\/4349"}],"wp:attachment":[{"href":"https:\/\/www.incredigeek.com\/home\/wp-json\/wp\/v2\/media?parent=4344"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.incredigeek.com\/home\/wp-json\/wp\/v2\/categories?post=4344"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.incredigeek.com\/home\/wp-json\/wp\/v2\/tags?post=4344"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}