- Enable Logging in PowerDNS Recursor Config
- Edit Systemd Unit File for PowerDNS to Allow Syslog
- Enable Logging in rsyslog Config File
The following links were helpful in setting things up.
https://doc.powerdns.com/recursor/running.html
https://www.reddit.com/r/linuxadmin/comments/9lc4jl/logging_queries_in_pdnsrecursor/
Enable logging in PowerDNS Recursor Config
First we need to find the line that says “disable-syslog” and uncomment/change it to
disable-syslog=no
Next find the line that says “quiet” and uncomment/change it to
quiet=no
Some other lines you may want to check and change
logging-facality=1
loglevel=6
Edit Systemd Unit File for PowerDNS to allow Syslog
Next we need to modify the Systemd unit file to allow PowerDNS Recursor to log to syslog.
systemctl edit --full pdns-recursor.service
On the ExecStart Line, remove the part that says
--disable-syslog
The resulting line should look something like
[Service]
ExecStart=/usr/sbin/pdns_recursor --socket-dir=%t/pdns-recursor --socket-dir=%t/pdns-recursor --daemon=no --write-pid=no --log-timestamp=no
Save the file.
Enable Logging in rsyslog Config File
Edit the rsyslog file
sudo vim /etc/rsyslog.conf
Add the following line
local1.* /var/log/pdns_recursor.log
This should now log all of the PowerDNS Recursor log info to “/var/log/pdns_recursor.log”
Restart the rsyslog and PowerDNS Recursor service
sudo systemctl restart rsyslog sudo systemctl restart pdns-recursor
You should now see DNS request in the log file.
tail /var/log/pdns_recursor.log
They should also show up in the “/var/log/messages”