Yesterday afternoon we moved our primary and secondary nameservers from hotrod and wheeljack to rumble and laserbeak. The move went flawlessly, with no loss of services.
To check that the new nameservers were receiving the requests we added query logging, following the instructions found in the comprehensive Ubuntu Server Guide. The logs began to fill with queries, which brought about the next problem: rotating the logs.
I believe that bind9 has the ability to rotate its own logs, however because we're using app-armor, I thought it would be best to do the rotation outside of bind. The rotation of logs is commonly handled with logrotate, so I created the following file:
mlambie@rumble:/var/log$ cat /etc/logrotate.d/query
/var/log/query.log {
daily
rotate 14
compress
delaycompress
missingok
notifempty
create 0664 bind root
postrotate
/etc/init.d/bind9 reload > /dev/null
endscript
}
I'm telling logrotate that I want the logs rotated daily, to keep the last two weeks (14 days), to compress the old logs (but not the most recently rotated log), it's OK if they're empty, don't rotate if they're empty (which will never be the case), to create new logs with the 664 permissions, owned by bind:root, and finally to reload bind9 after rotation. This last part is necessary otherwise bind will continue to use the rotated log, I think because it has an open file descriptor at rotation time.
I tested the rotation with:
mlambie@rumble:~$ sudo logrotate /etc/logrotate.d/query -f
The logs rotated as expected.