======Debian Lire Howto======

This is how I have lire setup to work for me.
----

First we have to install some package dependencies.
%%
apt-get install tetex-bin gs-common tetex-extra tetex-base latex-beamer latex-xcolor lmodern pgf preview-latex-style ploticus
%%

Now we install lire. Its that simple!
%%
apt-get install lire
%%

Now we have to configure bind9 to separate the log files.

Edit bind9's configuration file
%%
nano /etc/bind/named.conf
%%

Then at the very top add in the following section
%%
logging {
channel "misc" {
file "/var/log/misc.log" versions 2 size 25M;
severity info; print-severity no;
print-category yes; print-time yes;
};
channel "querylog" {
file "/var/log/named.log" versions 2 size 25M;
severity info; print-severity no;
print-category no; print-time yes;
};
category "queries" { "querylog"; };
category default { "misc"; };
};
%%

Prime the log files(The log location below assumes you have a chroot bind9 setup. If not the logs will be in /var/log/log.name)
%%
touch /var/lib/named/var/log/named.log
touch /var/lib/named/var/log/query.log
%%

Now restart bind9
%%
rndc reload
%%

The files /var/lib/named/var/log/named.log and query.log should now contain data. This is a good point to check. If they are empty, try;
%%
dig www.opennicproject.org @127.0.0.1
cat /var/lib/named/var/log/query.log
%%

That should have shown some data, if not go back and double check all steps. In order to handle the log files in regards to log rotation, I have chosen to use syslog-ng.
%%
apt-get install syslog-ng
%%

Now we configure syslog-ng to do log rotation. Create/edit this file in /etc/logrotate.d

%%
nano /etc/lograotate.d/syslog-ng
%%

Then add this, I have added the DNS log rotate information at the bottom

%%
/var/log/auth.log {
rotate 4
missingok
notifempty
weekly
compress
}

/var/log/cron.log {
rotate 4
weekly
missingok
notifempty
compress
}

/var/log/daemon.log {
rotate 7
weekly
missingok
notifempty
compress
}

/var/log/debug {
rotate 4
weekly
missingok
notifempty
compress
}

/var/log/kern.log {
rotate 4
weekly
missingok
notifempty
compress
}

/var/log/lpr.log {
rotate 4
weekly
missingok
notifempty
compress
}

/var/log/mail.err {
rotate 4
weekly
missingok
notifempty
compress
}

/var/log/mail.info {
rotate 4
weekly
missingok
notifempty
compress
}

/var/log/mail.log {
rotate 4
weekly
missingok
notifempty
compress
}

/var/log/mail.warn {
rotate 4
weekly
missingok
notifempty
compress
}

/var/log/messages {
rotate 4
weekly
missingok
notifempty
compress
}


/var/log/user.log {
rotate 4
weekly
missingok
notifempty
compress
}

/var/log/uucp.log {
rotate 4
missingok
notifempty
weekly
compress
}

/var/log/syslog {
rotate 7
daily
compress
postrotate
/etc/init.d/syslog-ng reload >/dev/null
endscript
}

/var/lib/named/var/log/query.log {
rotate 4
missingok
notifempty
weekly
compress
}

/var/lib/named/var/log/named.log {
rotate 4
missingok
notifempty
weekly
compress
}
%%

Now we restart syslog-ng
%%
/etc/init.d/syslog-ng restart
%%

Now lets test lire!
%%
cd ~
lr_log2report --output txt bind9_query /var/lib/named/var/log/query.log ~/bind9_query_report.txt
cat ~/bind9_query_report.tx
%%

There is your fresh lire report. Now lire can do alot more. To see the variety of formats for the reports issue;
%%
lr_xml2report --help output-formats
%%

You now have lire installed and working correctly! Below are a couple of my own recepies I use to analyze OpenNIC DNS data.

----