Unbound no longer logging after 23.01 update
-
I was recently troubleshooting a Suricata alert and i needed to review the unbound logs. I noticed there wasnt any in my syslog server. So i decided to take a look at the last 30 days and to my surprise Unbound has stopped sending anything to syslog (graylog). Correlating, this seems to have been around the 23.01 update.
Remote logging options have remained unchanged so not sure whats going on.
what shows up now are just debugs
-
Alrighty i found the issue.
I enabled Python Module under DNS resolver setting. Unchecking that and restarting Unbound i know see all my queries/answers in the logs.So the question is what does this setting even do? [im not sure why i even did this]
Firewall: NetGate,Palo Alto-VM,Juniper SRX
Routing: Juniper, Arista, Cisco
Switching: Juniper, Arista, Cisco
Wireless: Unifi, Aruba IAP
JNCIP,CCNP Enterprise -
@michmoor said in Unbound no longer logging after 23.01 update:
Alrighty i found the issue.
I enabled Python Module under DNS resolver setting. Unchecking that and restarting Unbound i know see all my queries/answers in the logs.Not sure what you mean. I've
and if I want to see a detailed unbound (resolver) query log, I go visit the logs of pfBlockerng :
Note this log is internal to pfblockerng, and not syslogged.
Or I switch unbound (resolver) to 'level 3' :
-
@michmoor How were you doing the logging? I was twiddling a bit today and added
server: log-queries: yesThat worked for 3 minutes then apparently stopped logging queries for no apparent reason, until I restarted Unbound just now:
Mar 31 22:29:00 unbound 98566 [98566:3] info: 10.x.x.x prod.nexusrules.live.com.akadns.net. A IN Mar 31 22:29:00 unbound 98566 [98566:1] info: 10.x.x.x prod.nexusrules.live.com.akadns.net. AAAA IN Mar 31 22:28:56 unbound 98566 [98566:0] info: start of service (unbound 1.13.2). Mar 31 22:28:56 unbound 98566 [98566:0] notice: init module 0: iterator Mar 31 11:42:15 unbound 88124 [88124:2] info: 10.x.x.x array501.prod.do.dsp.mp.microsoft.com. A IN Mar 31 11:42:15 unbound 88124 [88124:3] info: 10.x.x.x array501.prod.do.dsp.mp.microsoft.com. AAAA IN -
Hmm, never mind, I poked around other logs and see
Mar 31 11:42:22 syslogd kernel boot file is /boot/kernel/kernel Mar 31 11:42:21 syslogd exiting on signal 15...so apparently there was a reason it stopped logging. Just not a good one.
