Unbound DNS sever does not log anything when I make a query

Question

I have recently started using unbound dns.

I have configured all the things I need properly. But the server doesn't log when I make a query.

I have no errors in the unbound.conf file

The following is my .conf file

# The server clause sets the main parameters.
server:
# whitespace is not necessary, but looks cleaner.

# verbosity number, 0 is least verbose. 1 is default.
verbosity: 1

# print statistics to the log (for every thread) every N seconds.
# Set to "" or 0 to disable. Default is disabled.
statistics-interval: 5


interface: 192.168.116.134

# port to answer queries from
port: 53


cache-min-ttl: 400
cache-max-ttl: 86400


# Enable IPv4, "yes" or "no".
do-ip4: yes

# Enable IPv6, "yes" or "no".
# do-ip6: yes

# Enable UDP, "yes" or "no".
    do-udp: yes

# Enable TCP, "yes" or "no".
    do-tcp: yes



access-control: 0.0.0.0/0 allow

# chroot: "/etc/unbound"


# username: "unbound"


# directory: "/etc/unbound"

# the log file, "" means log to stderr.
# Use of this option sets use-syslog to "no".
logfile: "/var/log/unbound/unbound.log"

forward-zone:
name: "."
forward-addr: 8.8.4.4
forward-addr: 8.8.8.8  

The lig file does exist in the given directory and I have made the unbound user its owner using chown, but when I make a query the log file is still empty.

Platform: Ubuntu 18 Desktop

Answer 1

The Unbound Debian/Ubuntu/similar package logs to /var/log/syslog by default. After some trial and error I figured out how to change it.

Step 1

Make sure all CHROOT directives are commented out and log directive added:

Search for the directive:

sudo grep -R "chroot" /etc/unbound/*

Note: We are searching entire config area. Your configuration file location may vary. I keep mine under /etc/unbound/unbound.conf.d/99-custom-(servername).conf.

At any rate, you should see something like this if commented out correctly:

# chroot:""

Also make sure you have these entries in your config file:

 use-syslog: no
 logfile: "/var/log/unbound/unbound.log"

Note: You can save the log anywhere you like, but you will have to adjust paths/filenames if you follow the rest of this guide.

Step 2

Make sure to create the folder/file with proper owner (unbound) and privileges:

sudo mkdir /var/log/unbound && sudo chmod 755 /var/log/unbound
sudo touch /var/log/unbound/unbound.log
sudo chown unbound:unbound /var/log/unbound /var/log/unbound/unbound.log

After restarting the service, it was still not working for me (or you).

I noticed it was still logging to syslog after turning up verbosity to debug. I also noticed some kernel logging showing "apparmor" was logging "DENIED" for the unbound log location access:

sudo cat /var/log/syslog | grep DENIED

Example in syslog:

 Dec 30 16:41:48 ip-192-168-1-1 kernel: [ 1368.641789] audit: type=1400 audit(1577724108.624:29): apparmor="DENIED" operation="open" profile="/usr/sbin/unbound" name="/var/log/unbound/unbound.log" pid=2247 comm="unbound" requested_mask="ac" denied_mask="ac" fsuid=112 ouid=112

Step 3

To correct this, I added a local override to apparmor.d area:

sudo nano /etc/apparmor.d/local/usr.sbin.unbound

Add this single line to it:

/var/log/unbound/unbound.log rw,

(Yes, with a comma on the end.) Save.

Step 4

Reload apparmor entries for unbound:

sudo apparmor_parser -r /etc/apparmor.d/usr.sbin.unbound

Step 5

Restart Unbound:

sudo systemctl restart unbound

Check log:

$ sudo tail -f /var/log/unbound/unbound.log
[1577725445] unbound[2721:0] info: start of service (unbound 1.6.7).

WORKS. If you notice, when syslog logs it, it uses a standard date format. But, Unbound custom logging/non-syslog uses Unix/Epoch time (seconds since 1970) by default. If you wish to have timestamps like syslog, add this to your unbound config and reload service:

log-time-ascii: yes

Step 6

Log rotation:

If you wish the Unbound log to be rotated with the logrotate service (you should), add this bit to the file /etc/logrotate.d/unbound:

/var/log/unbound/*.log {
    weekly
    rotate 7
    missingok
    notifempty
    compress
    delaycompress
    sharedscripts
    create 644
    postrotate
        /usr/sbin/unbound-control log_reopen
    endscript
}

Restart it all:
sudo systemctl restart logrotate.service unbound.service

Keep on eye on logging for a week or two to make sure things are logging and rotating correctly.

---

My config:
gist text

References:
https://nlnetlabs.nl/documentation/unbound/unbound.conf/
https://wiki.debian.org/AppArmor/Debug
https://gist.github.com/kometchtech/06fc3326c83338afd151

Answer 2

You need to set a proper verbosity level. 3 should be sufficient.

verbosity: <number>
          The verbosity number, level 0 means no verbosity,  only  errors.
          Level  1  gives  operational information. Level 2 gives detailed
          operational information. Level 3 gives query level  information,
          output  per  query.   Level 4 gives algorithm level information.
          Level 5 logs client identification for cache misses.  Default is
          level  1.  The verbosity can also be increased from the command-
          line, see unbound(8).

Answer 3

You are running in a chroot environment (/etc/unbound), which means your log should actually be kept at /etc/unbound/var/log/unbound/unbound.log. Is this where you are looking for it?

Answer 4

This is same answer as @b. shea. Just the steps automated with ansible.

- name: unbound logging
  ansible.builtin.file:
    path: /var/log/unbound
    state: directory
    owner: unbound
    group: unbound
  become: true

- name: unbound logging - file
  ansible.builtin.file:
    path: /var/log/unbound/unbound.log
    state: touch
    owner: unbound
    group: unbound
  become: true

- name: unbound logging - apparmor
  ansible.builtin.copy:
    dest: /etc/apparmor.d/local/usr.sbin.unbound
    content: |
      /var/log/unbound/unbound.log rw,
  register: unbound_apparmor
  become: true

- name: unbound logging - apparmor parse
  ansible.builtin.shell:
    cmd: apparmor_parser -r /etc/apparmor.d/usr.sbin.unbound
  become: true
  when: unbound_apparmor.changed