?
Solved

Logging Query's on a Windows 2000 DNS Server

Posted on 2009-05-15
7
Medium Priority
?
1,172 Views
Last Modified: 2013-12-05
I have a Windows 2000 DNS Server.  I am trying to setup logging so I can track to see what websites clients are accessing.  I have looked at the Logging on the DNS Server and selected query, but when I do some web browsing, nothing shows up in the log.  Is there a way to have this show up?
0
Comment
Question by:supertechhawaii
  • 4
  • 3
7 Comments
 
LVL 8

Expert Comment

by:zoubi77
ID: 24403648
Yes there is a way.

By default debug logging is turned off, because it is high intesitive process and log file can grow oversize very quickly and can seriously degrade DNS server's performance

To select and enable debug logging options on the DNS server

   1. Open DNS
   2. In the console tree, click the applicable DNS server.
   3. On the Action menu, click Properties.
   4. Click the Logging tab.
   5. Select the events that you want the DNS server to record for debug logging, and then click OK.

But be aware! Using debug logging options slows DNS server performance.

Log file is than created an it's located in systemroot\System32\Dns

Good luck ;)

0
 

Author Comment

by:supertechhawaii
ID: 24403692
Aloha Zoubi77,
  Thanks for the reply.  I have enabled the logging, however, I am not sure what log to enabe to see the web query that hit the dns.  What should I enaable.

Thanks,
supertechhawaii
0
 
LVL 8

Expert Comment

by:zoubi77
ID: 24403725
Here are explanations of options

    * Query  Logs queries received by the DNS Server service from clients.
    * Notify  Logs notification messages received by the DNS Server service from other servers.
    * Update  Logs dynamic updates received by the DNS Server service from other computers.
    * Questions  Logs the contents of the question section for each DNS query message processed by the DNS Server service.
    * Answers  Logs the contents of the answer section for each DNS query message processed by the DNS Server service.
    * Send  Logs the number of DNS query messages sent by the DNS Server service.
    * Receive  Logs the number of DNS query messages received by the DNS Server service.
    * UDP  Logs the number of DNS requests received by the DNS Server service over a UDP port.
    * TCP  Logs the number of DNS requests received by the DNS Server service over a TCP port.
    * Full packets  Logs the number of full packets written and sent by the DNS Server service.
    * Write through  Logs the number of packets written through by the DNS Server service and back to the zone.


You should enable QUERY...
0
Get your Conversational Ransomware Defense e‑book

This e-book gives you an insight into the ransomware threat and reviews the fundamentals of top-notch ransomware preparedness and recovery. To help you protect yourself and your organization. The initial infection may be inevitable, so the best protection is to be fully prepared.

 

Author Comment

by:supertechhawaii
ID: 24403869
Aloha zoubi77,
  Thanks for the quick response.  On Monday I will try to enable the query log and see if this works.  I will post a reply to an update.

thanks,
supertechhawaii
0
 

Author Comment

by:supertechhawaii
ID: 24415269
Aloha Zoubi77,
   I have enabled the "Query" log file.  I have been surffing the web and nothing is being written to the log file.  Any other thoughts as to what I am doing wrong ;)

Thanks,
Brian
0
 
LVL 8

Expert Comment

by:zoubi77
ID: 24416262
Hm..hard to say..First try to enable ALL of the options and see if it something shows in the log file. Is Ethereal an option for you (it's very-easy-to-use packet sniffer)

Hope it helps,

Grega
0
 

Accepted Solution

by:
supertechhawaii earned 0 total points
ID: 24417488
Aloha zoubi77,
  I have enabled the the options, and yes it does show me info in the log file :)  Is there a way to just show me where the request came from (IP address) and what was being asked (Web site location) ?
0

Featured Post

Get your Conversational Ransomware Defense e‑book

This e-book gives you an insight into the ransomware threat and reviews the fundamentals of top-notch ransomware preparedness and recovery. To help you protect yourself and your organization. The initial infection may be inevitable, so the best protection is to be fully prepared.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Welcome to my series of short tips on migrations. Whilst based on Microsoft migrations the same principles can be applied to any type of migration. My first tip Migration Tip #1 – Source Server Health can be found listed in my profile here: http:…
I wrote this article to explain some important DNS concepts that should be known to avoid some typical configuration errors I often see in forums. I assume that what is described here is the typical behavior of Microsoft DNS client. I don't know …
Exchange organizations may use the Journaling Agent of the Transport Service to archive messages going through Exchange. However, if the Transport Service is integrated with some email content management application (such as an anti-spam), the admin…
Are you ready to place your question in front of subject-matter experts for more timely responses? With the release of Priority Question, Premium Members, Team Accounts and Qualified Experts can now identify the emergent level of their issue, signal…

850 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question