<html><head><title></title></head><body><!-- rte-version 0.2 9947551637294008b77bce25eb683dac --><div class="rte-style-maintainer rte-pre-wrap" data-color="global-default" bbg-color="default" data-bb-font-size="medium"bbg-font-size="medium" style="font-family: Arial, "BB.Proportional"; white-space: pre-wrap; font-size: small;"style="font-family: Arial, "BB.Proportional"; white-space: pre-wrap; font-size: small; color: rgb(0, 0, 0);">Thank you Brian... The host was a typo, they are the same host.<div><br></div><div>The output from journalctl is more confusing to me and imho the crux of the problem.</div><div><br></div><div>Why is journalctl showing 2 log entries 1 for pdns_server and one for pdns (both with the same pid).</div><div><br></div><div>journalctl -u pdns --no-pager | tail -2</div><div bbg-color="RED" style="color: rgb(237, 0, 0);">Sep 14 10:49:01 xxxxxx-209 pdns[103973]: AXFR of domain 'foo.bar.com' to 1.2.3.4 finished</div><div bbg-color="RED" style="color: rgb(237, 0, 0);">Sep 14 10:49:01 xxxxxx-209 pdns_server[103973]: AXFR of domain 'foo.bar.com' to 1.2.3.4 finished</div><div bbg-color="RED" style="color: rgb(237, 0, 0);"><br style="color: rgb(255, 44, 74);"></div><div>I would not think that would be an rsyslog issue.</div><div><br><div class="rte-style-maintainer" data-color="global-default"bbg-color="default" data-bb-font-size="medium" bbg-font-size="medium" style="font-size: small; font-family: "Courier New", Courier, "BB.FixedWidth";"style="font-size: small; font-family: "Courier New", Courier, "BB.FixedWidth"; color: rgb(0, 0, 0);"><div><div class="bbg-rte-fold-content" data-header="From: b.candler@pobox.com At: 09/14/23 10:44:05 UTC-4:00"data-digest="From: b.candler@pobox.com At: 09/14/23 10:44:05 UTC-4:00" style=""><div class="bbg-rte-fold-summary">From: b.candler@pobox.com At: 09/14/23 10:44:05 UTC-4:00</div>To: <a spellcheck="false" bbg-destination="mailto:igoldstein5@bloomberg.net" href="mailto:igoldstein5@bloomberg.net"> Ian Goldstein (BLOOMBERG/ 120 PARK ) </a>, <a spellcheck="false"bbg-destination="mailto:pdns-users@mailman.powerdns.com" href="mailto:pdns-users@mailman.powerdns.com"> pdns-users@mailman.powerdns.com</a><br>Subject: Re: [Pdns-users] Logging to /var/log/messages</div><br></div><div class="rte-internet-block-wrapper" style="background: white; color: black; font-family: Arial, "BB.Proportional"; font-size: small; white-space: normal;"><div class="rte-internet-block"><blockquote> <div class="moz-cite-prefix">On 14/09/2023 15:32, Ian Goldstein (BLOOMBERG/ 120 PARK) wrote:<br> </div> <blockquote type="cite" cite="mid:6503197D0002A67E0C430001@message.bloomberg.net"> <div>The log entry that appears in my pdns.log is:</div> <div><span bbg-color="RED" style="color: rgb(237, 0, 0);">Sep 14 09:07:52 xxxxxx-232 </span><span bbg-color="BLUE"style="color: rgb(4, 94, 201);">pdns</span><span bbg-color="RED"style="color: rgb(237, 0, 0);">[1380]: AXFR of domain 'foo.bar.com' to 1.2.3.4 finished</span></div> <div bbg-color="RED" style="color: rgb(237, 0, 0);"><br style="color: rgb(255, 44, 74);"> </div> <div>The entry that appears in /var/log/messages:</div> <div><span bbg-color="RED" style="color: rgb(237, 0, 0);">Sep 14 09:26:30 xxxxxx-209 </span><span bbg-color="BLUE"style="color: rgb(4, 94, 201);">pdns_server</span><span bbg-color="RED" style="color: rgb(237, 0, 0);">: AXFR of domain 'foo.bar.com' initiated by 1.2.3.4</span></div> <div><br> </div> <div>also, the output from journalctl shows 2 entries</div> <div><span bbg-color="RED" style="color: rgb(237, 0, 0);">Sep 14 10:22:41 xxxxxx-209 </span><span bbg-color="BLUE"style="color: rgb(4, 94, 201);">pdns_server</span><span bbg-color="RED" style="color: rgb(237, 0, 0);">[98865]: AXFR of domain 'foo.bar.com' to 1.2.3.4finished</span></div> <div><span bbg-color="RED" style="color: rgb(237, 0, 0);">Sep 14 10:22:41 xxxxxx-209 </span><span bbg-color="BLUE"style="color: rgb(4, 94, 201);">pdns</span><span bbg-color="RED"style="color: rgb(237, 0, 0);">[98865]: AXFR of domain 'foo.bar.com' to 1.2.3.4 finished</span></div> </blockquote> <p>xxxxxx-232 and xxxxxx-209 appear to be two different hostnames, and you might want to check why one is running "pdns", one is running "pdns_server", and some logs show the PID and some don't. Basically those logs are <a spellcheck="false"bbg-destination="https://blog.powerdns.com/2016/01/18/open-source-support-out-in-the-open"class="" href="https://blog.powerdns.com/2016/01/18/open-source-support-out-in-the-open"data-destination="https://blog.powerdns.com/2016/01/18/open-source-support-out-in-the-open">too obfuscated to be meaningful.</a></p> <p>journalctl is going to show the logs which are coming directly from powerdns on stdout/stderr.<br> </p> <p>Apart from that, I think you'd be better off asking your question on an rsyslog mailing list, since powerdns has no control over how rsyslog processes or writes logs.<br> </p> </blockquote><br></div></div></div></div></div></body></html>