[Pdns-users] pdns-recursor query logging of cached requests

[Otto Moerbeek]

On Thu, Nov 03, 2022 at 02:08:53PM +0100, Marco Kleefman via Pdns-users wrote:

> Hi,
> 
> For compliancy reasons we are configuring query logging on our PowerDNS
> recursor instances (running 4.7.3).
> 
> For normal queries I see source-ip and content of DNS question. Example
> logging:
> 
> pdns_recursor[12056]: 2 [395002/1] question for 'www.exampledomain.com|A'
> from 10.11.12.13:56765
> 
> For a cached query I only see this in my (journald + syslog) logging:
> 
> pdns_recursor[12056]: 3 question answered from packet cache tag=0 from
> 173.172.171.170:51200
> 
> I tried increasing loglevel parameter to 7 (debug) but no additional
> logging becomes available for cached requests.
> 
> Does anybody have any tips how to log the content of a query which gets
> answered from the cache?
> 
> Regards,
> 
> Marco
> 
> OS: CentOS 7.9.200
> PDNS: pdns-recursor.x86_64                 4.7.3-1pdns.el7
> @powerdns-rec-47
> 
> related config in /etc/pdns-recursor/recursor.conf:
> 
> disable-syslog=no
> logging-facility=0
> loglevel=4
> quiet=no

The text logging is indeed limited. 4.8 (to be released in December)
will improve on that. You could try a beta version:

https://blog.powerdns.com/2022/10/05/first-beta-release-of-powerdns-recursor-4-8-0/

But in general, text logging is quite CPU intensive. I would use
protobuf logging, which is much easier on the CPU. See

https://docs.powerdns.com/recursor/lua-config/protobuf.html#configuring-protocol-buffer-logs

	-Otto