Can't get dnsmasq to log queries

[sbsnb]

Using Merlin 380.68. Added log-queries line to /jffs/configs/dnsmasq.conf.add and service dnsmasq_restart. Still nothing in logs. Added log-facility=/tmp/mnt/sda1/dnsmasq.log to dnsmasq.conf.add and restart. Nothing. I tried creating the dnsmasq.log file and setting it to RW for everyone. Nothing. I know dnsmasq.conf.add is being processed because I have a no-resolv line that generates a warning in the syslog. What am I missing?

 

[sbsnb]

I noticed when you change dnsmasq settings in the UI the following log entries are generated:

Sep 13 09:19:41 rc_service: httpd 560:notify_rc restart_dnsmasq
Sep 13 09:19:41 custom_config: Appending content of /jffs/configs/dnsmasq.conf.add.

But when you restart dnsmasq from a terminal the log shows no notification about appending dnsmasq.conf.add. I confirmed with /etc/dnsmasq.conf that restarting dnsmasq from a terminal does not append dnsmasq.conf.add. I was hoping this was my issue, but I tried changing some settings in the UI and applying them to trigger a restart of dnsmasq and confirmed that log-queries appears in /etc/dnsmasq.conf, but it's still not logging queries.

 

[ColinTaylor]

I think when another forum user was doing this the other day they had the same problem because they were suppressing the dnsmasq messages in the webUI, or their log level was set incorrectly. So check the settings in the webUI.

 

[sbsnb]

I set the log level to debug. Now I see the following every 5 seconds:

Sep 13 10:02:06 dnsmasq[1855]: 1420 127.0.0.1/47793 query[A] dns.msftncsi.com from 127.0.0.1
Sep 13 10:02:06 dnsmasq[1855]: 1420 127.0.0.1/47793 cached dns.msftncsi.com is 131.107.255.255

But when I manually query dnsmasq with nslookup nothing shows up in the logs. Nothing shows up except those damn windows queries checking if it's online.

 

[ColinTaylor]

Where are you do the nslookup from, a PC? Maybe the DNS is set wrong on the PC or you are using DNS Filter.

C:\Users\Colin>nslookup
Default Server:  router.asus.com
Address:  192.168.1.1

> www.google.co.uk
Server:  router.asus.com
Address:  192.168.1.1

Non-authoritative answer:
Name:    www.google.co.uk
Addresses:  2a00:1450:4009:815::2003
          216.58.204.35

>

 

[TechTinkerer]

@ColinTaylor
How do i change log level as having same issue as op? Thanks

 

[ColinTaylor]

@ColinTaylor
How do i change log level as having same issue as op? Thanks

Have you created the custom config file as per the first sentence in post #1?

 

[TechTinkerer]

Have you created the custom config file as per the first sentence in post #1?

Just had to re-add the line: log-facility=/opt/var/log/dnsmasq.log

but on restarting with service restart_dnsmasq it empties the file is that supposed to happen?

 

[ColinTaylor]

but on restarting the dns service it empties the file is that supposed to happen?

Yes.

 

[TechTinkerer]

Yes.

As i didnt originally have a dnsmasq.log i had to enable it

added entry: log-facility=/opt/var/log/dnsmasq.log
but on restarting the service it removes the entry from dnsmasq.conf.add

Just trying to capture dns queries nothing gets captured in log

Thanks, Colin

 

[ColinTaylor]

Check the contents of /jffs/configs/dnsmasq.conf.add

Do you have any third party software installed that manipulates DNS log entries?

 

[TechTinkerer]

Check the contents of /jffs/configs/dnsmasq.conf.add

Do you have any third party software installed that manipulates DNS log entries?

no, third party software, i just added
log-facility=/opt/var/log/dnsmasq.log

as previous noted if i restart service it removes the entry

 

[dave14305]

no, third party software, i just added
log-facility=/opt/var/log/dnsmasq.log

as previous noted if i restart service it removes the entry

What about /jffs/scripts/dnsmasq.postconf? Nothing should be removing the contents of dnsmasq.conf.add.

 

[TechTinkerer]

What about /jffs/scripts/dnsmasq.postconf? Nothing should be removing the contents of dnsmasq.conf.add.

empty

 

[ColinTaylor]

no, third party software,

So you're not running any of the software listed in your signature at the moment?

 

[dave14305]

empty

/jffs/scripts/service-event ?

 

[TechTinkerer]

/jffs/scripts/service-event ?

Just has scribe kill-logger,yazfi,spdmerlin - service event

 

[TechTinkerer]

So you're not running any of the software listed in your signature at the moment?

Sorry, i was thinking something else...yes i'm running all of that, on my sig all uptodate