Debian Lire Howto
This is how I have lire setup to work for me.
First we have to install some package dependencies.
apt-get install tetex-bin gs-common tetex-extra tetex-base latex-beamer latex-xcolor lmodern pgf preview-latex-style ploticus
Now we install lire. Its that simple!
apt-get install lire
Now we have to configure bind9 to separate the log files.
Edit bind9's configuration file
nano /etc/bind/named.conf
Then at the very top add in the following section
logging {
channel "misc" {
file "/var/log/misc.log" versions 2 size 25M;
severity info; print-severity no;
print-category yes; print-time yes;
};
channel "querylog" {
file "/var/log/named.log" versions 2 size 25M;
severity info; print-severity no;
print-category no; print-time yes;
};
category "queries" { "querylog"; };
category default { "misc"; };
};Prime the log files(The log location below assumes you have a chroot bind9 setup. If not the logs will be in /var/log/log.name)
touch /var/lib/named/var/log/named.log touch /var/lib/named/var/log/query.log
Now restart bind9
rndc reload
The files /var/lib/named/var/log/named.log and query.log should now contain data. This is a good point to check. If they are empty, try;
dig www.opennicproject.org @127.0.0.1 cat /var/lib/named/var/log/query.log
That should have shown some data, if not go back and double check all steps. In order to handle the log files in regards to log rotation, I have chosen to use syslog-ng.
apt-get install syslog-ng
Now we configure syslog-ng to do log rotation. Create/edit this file in /etc/logrotate.d
nano /etc/lograotate.d/syslog-ng
Then add this, I have added the DNS log rotate information at the bottom
/var/log/auth.log {
rotate 4
missingok
notifempty
weekly
compress
}
/var/log/cron.log {
rotate 4
weekly
missingok
notifempty
compress
}
/var/log/daemon.log {
rotate 7
weekly
missingok
notifempty
compress
}
/var/log/debug {
rotate 4
weekly
missingok
notifempty
compress
}
/var/log/kern.log {
rotate 4
weekly
missingok
notifempty
compress
}
/var/log/lpr.log {
rotate 4
weekly
missingok
notifempty
compress
}
/var/log/mail.err {
rotate 4
weekly
missingok
notifempty
compress
}
/var/log/mail.info {
rotate 4
weekly
missingok
notifempty
compress
}
/var/log/mail.log {
rotate 4
weekly
missingok
notifempty
compress
}
/var/log/mail.warn {
rotate 4
weekly
missingok
notifempty
compress
}
/var/log/messages {
rotate 4
weekly
missingok
notifempty
compress
}
/var/log/user.log {
rotate 4
weekly
missingok
notifempty
compress
}
/var/log/uucp.log {
rotate 4
missingok
notifempty
weekly
compress
}
/var/log/syslog {
rotate 7
daily
compress
postrotate
/etc/init.d/syslog-ng reload >/dev/null
endscript
}
/var/lib/named/var/log/query.log {
rotate 4
missingok
notifempty
weekly
compress
}
/var/lib/named/var/log/named.log {
rotate 4
missingok
notifempty
weekly
compress
}Now we restart syslog-ng
/etc/init.d/syslog-ng restart
Now lets test lire!
cd ~ lr_log2report --output txt bind9_query /var/lib/named/var/log/query.log ~/bind9_query_report.txt cat ~/bind9_query_report.tx
There is your fresh lire report. Now lire can do alot more. To see the variety of formats for the reports issue;
lr_xml2report --help output-formats
You now have lire installed and working correctly! Below are a couple of my own recepies I use to analyze OpenNIC DNS data.
