Discussion:
unexpected behaviour of rndc dnstap -roll
(too old to reply)
Jakob Dhondt
2020-06-17 15:55:06 UTC
Permalink
Hi everyone,

I am generating dnstap files using bind and regularly roll them using
'rndc dnstap -roll [number]'. The way I understand the documentation is
that there should be max [number] old dnstap files after executing this
command but what actually happens is that all files are being kept so
that I have to remove the old ones myself.

This is what the documentation says:

dnstap ( -reopen | -roll [number] )
... If number is specified, then the number of backup log files is
limited to that number.

Am I missing something here? Is the behaviour that I'm observing the
expected one? The logs don't tell me much and I couldn't find any hints
about this on the Internet. Thanks for any help!

Kind regards,

Jakob
--
SWITCH
Jakob Dhondt, Security Engineer, SWITCH-CERT
Werdstrasse 2, P.O. Box, 8021 Zurich, Switzerland
phone +41 44 268 15 15, direct +41 44 268 16 23
***@switch.ch, www.switch.ch
Security-News: securityblog.switch.ch
Tony Finch
2020-06-21 20:30:01 UTC
Permalink
Post by Jakob Dhondt
I am generating dnstap files using bind and regularly roll them using
'rndc dnstap -roll [number]'. The way I understand the documentation is
that there should be max [number] old dnstap files after executing this
command but what actually happens is that all files are being kept so
that I have to remove the old ones myself.
Yes, this is a bug. I could reproduce the problem but I couldn't see it
by staring at the code, so I added some extra logging until I found
the mistake. I've submitted a merge request for this patch:

https://gitlab.isc.org/fanf/bind9/-/commit/29d275965c0cddc862eeccb28188b8fd124fb321

Tony.
--
f.anthony.n.finch <***@dotat.at> http://dotat.at/
public services available on equal terms to all
Jakob Dhondt
2020-06-22 06:58:37 UTC
Permalink
Thanks for your help!
Post by Tony Finch
Post by Jakob Dhondt
I am generating dnstap files using bind and regularly roll them using
'rndc dnstap -roll [number]'. The way I understand the documentation is
that there should be max [number] old dnstap files after executing this
command but what actually happens is that all files are being kept so
that I have to remove the old ones myself.
Yes, this is a bug. I could reproduce the problem but I couldn't see it
by staring at the code, so I added some extra logging until I found
https://gitlab.isc.org/fanf/bind9/-/commit/29d275965c0cddc862eeccb28188b8fd124fb321
Tony.
--
SWITCH
Jakob Dhondt, Security Engineer, SWITCH-CERT
Werdstrasse 2, P.O. Box, 8021 Zurich, Switzerland
phone +41 44 268 15 15, direct +41 44 268 16 23
***@switch.ch, www.switch.ch
Security-News: securityblog.switch.ch
Loading...