Solved

Logging Query's on a Windows 2000 DNS Server

Posted on 2009-05-15
7
1,135 Views
Last Modified: 2013-12-05
I have a Windows 2000 DNS Server.  I am trying to setup logging so I can track to see what websites clients are accessing.  I have looked at the Logging on the DNS Server and selected query, but when I do some web browsing, nothing shows up in the log.  Is there a way to have this show up?
0
Comment
Question by:supertechhawaii
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 3
7 Comments
 
LVL 8

Expert Comment

by:zoubi77
ID: 24403648
Yes there is a way.

By default debug logging is turned off, because it is high intesitive process and log file can grow oversize very quickly and can seriously degrade DNS server's performance

To select and enable debug logging options on the DNS server

   1. Open DNS
   2. In the console tree, click the applicable DNS server.
   3. On the Action menu, click Properties.
   4. Click the Logging tab.
   5. Select the events that you want the DNS server to record for debug logging, and then click OK.

But be aware! Using debug logging options slows DNS server performance.

Log file is than created an it's located in systemroot\System32\Dns

Good luck ;)

0
 

Author Comment

by:supertechhawaii
ID: 24403692
Aloha Zoubi77,
  Thanks for the reply.  I have enabled the logging, however, I am not sure what log to enabe to see the web query that hit the dns.  What should I enaable.

Thanks,
supertechhawaii
0
 
LVL 8

Expert Comment

by:zoubi77
ID: 24403725
Here are explanations of options

    * Query  Logs queries received by the DNS Server service from clients.
    * Notify  Logs notification messages received by the DNS Server service from other servers.
    * Update  Logs dynamic updates received by the DNS Server service from other computers.
    * Questions  Logs the contents of the question section for each DNS query message processed by the DNS Server service.
    * Answers  Logs the contents of the answer section for each DNS query message processed by the DNS Server service.
    * Send  Logs the number of DNS query messages sent by the DNS Server service.
    * Receive  Logs the number of DNS query messages received by the DNS Server service.
    * UDP  Logs the number of DNS requests received by the DNS Server service over a UDP port.
    * TCP  Logs the number of DNS requests received by the DNS Server service over a TCP port.
    * Full packets  Logs the number of full packets written and sent by the DNS Server service.
    * Write through  Logs the number of packets written through by the DNS Server service and back to the zone.


You should enable QUERY...
0
Online Training Solution

Drastically shorten your training time with WalkMe's advanced online training solution that Guides your trainees to action. Forget about retraining and skyrocket knowledge retention rates.

 

Author Comment

by:supertechhawaii
ID: 24403869
Aloha zoubi77,
  Thanks for the quick response.  On Monday I will try to enable the query log and see if this works.  I will post a reply to an update.

thanks,
supertechhawaii
0
 

Author Comment

by:supertechhawaii
ID: 24415269
Aloha Zoubi77,
   I have enabled the "Query" log file.  I have been surffing the web and nothing is being written to the log file.  Any other thoughts as to what I am doing wrong ;)

Thanks,
Brian
0
 
LVL 8

Expert Comment

by:zoubi77
ID: 24416262
Hm..hard to say..First try to enable ALL of the options and see if it something shows in the log file. Is Ethereal an option for you (it's very-easy-to-use packet sniffer)

Hope it helps,

Grega
0
 

Accepted Solution

by:
supertechhawaii earned 0 total points
ID: 24417488
Aloha zoubi77,
  I have enabled the the options, and yes it does show me info in the log file :)  Is there a way to just show me where the request came from (IP address) and what was being asked (Web site location) ?
0

Featured Post

Office 365 Training for IT Pros

Learn how to provision tenants, synchronize on-premise Active Directory, implement Single Sign-On, customize Office deployment, and protect your organization with eDiscovery and DLP policies.  Only from Platform Scholar.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

On a regular basis I get questions about slow RDP performance, RDP connection problems, strange errors and even BSOD, remote computers freezing or restarting after initiation of a remote session. In a lot of this cases the quick solutions made b…
If you have a multi-homed DNS setup in windows, you can have issues with connectivity to the server that hosts the DNS services (or even member servers of your domain if this same DNS server is a DC). This is because windows registers all of its IPs…
Exchange organizations may use the Journaling Agent of the Transport Service to archive messages going through Exchange. However, if the Transport Service is integrated with some email content management application (such as an antispam), the admini…
Are you ready to implement Active Directory best practices without reading 300+ pages? You're in luck. In this webinar hosted by Skyport Systems, you gain insight into Microsoft's latest comprehensive guide, with tips on the best and easiest way…

732 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question