<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<div class="moz-cite-prefix">On 14/09/2023 15:32, Ian Goldstein
(BLOOMBERG/ 120 PARK) wrote:<br>
</div>
<blockquote type="cite"
cite="mid:6503197D0002A67E0C430001@message.bloomberg.net">
<div>The log entry that appears in my pdns.log is:</div>
<div><span bbg-color="RED" style="color: rgb(237, 0, 0);">Sep 14
09:07:52 xxxxxx-232 </span><span bbg-color="BLUE"
style="color: rgb(4, 94, 201);">pdns</span><span
bbg-color="RED" style="color: rgb(237, 0, 0);">[1380]: AXFR of
domain 'foo.bar.com' to 1.2.3.4 finished</span></div>
<div bbg-color="RED" style="color: rgb(237, 0, 0);"><br
style="color: rgb(255, 44, 74);">
</div>
<div>The entry that appears in /var/log/messages:</div>
<div><span bbg-color="RED" style="color: rgb(237, 0, 0);">Sep 14
09:26:30 xxxxxx-209 </span><span bbg-color="BLUE"
style="color: rgb(4, 94, 201);">pdns_server</span><span
bbg-color="RED" style="color: rgb(237, 0, 0);">: AXFR of
domain 'foo.bar.com' initiated by 1.2.3.4</span></div>
<div><br>
</div>
<div>also, the output from journalctl shows 2 entries</div>
<div><span bbg-color="RED" style="color: rgb(237, 0, 0);">Sep 14
10:22:41 xxxxxx-209 </span><span bbg-color="BLUE"
style="color: rgb(4, 94, 201);">pdns_server</span><span
bbg-color="RED" style="color: rgb(237, 0, 0);">[98865]: AXFR
of domain 'foo.bar.com' to 1.2.3.4finished</span></div>
<div><span bbg-color="RED" style="color: rgb(237, 0, 0);">Sep 14
10:22:41 xxxxxx-209 </span><span bbg-color="BLUE"
style="color: rgb(4, 94, 201);">pdns</span><span
bbg-color="RED" style="color: rgb(237, 0, 0);">[98865]: AXFR
of domain 'foo.bar.com' to 1.2.3.4 finished</span></div>
</blockquote>
<p>xxxxxx-232 and xxxxxx-209 appear to be two different hostnames,
and you might want to check why one is running "pdns", one is
running "pdns_server", and some logs show the PID and some don't.
Basically those logs are <a moz-do-not-send="true"
href="https://blog.powerdns.com/2016/01/18/open-source-support-out-in-the-open">too
obfuscated to be meaningful.</a></p>
<p>journalctl is going to show the logs which are coming directly
from powerdns on stdout/stderr.<br>
</p>
<p>Apart from that, I think you'd be better off asking your question
on an rsyslog mailing list, since powerdns has no control over how
rsyslog processes or writes logs.<br>
</p>
</body>
</html>