Improve zone transfer logging to always include an identifying serial number so that starts and ends can be matched by log parsers
The problem statement/use case is this
...we use Splunk to ingest all transfer logs on the distribution
masters...and neither Splunk nor our "SOA serial Sync" monitoring in
Nagios(icinga) see large spikes when it comes to zone distribution times.
(We would, however, like to request that you modify BIND logging to
include the zone serial in the 'IXFR ended' line...as the tokens we're
matching on to link start/end sometimes cause false spikes when the
random port and the random client id match with previous events... :)
This is from Support ticket #15075
It's possible that some of this difficulty relates to #1009 (closed) (now fixed) wherein all endings are logged, but some zone transfer starts are missing. But nevertheless, I don't see that serial numbers are logged on zone transfer endings, just this (from the inbound transfer server's PoV):
/*
* Calculate the length of time the transfer took,
* and print a log message with the bytes and rate.
*/
isc_time_now(&xfr->end);
msecs = isc_time_microdiff(&xfr->end, &xfr->start) / 1000;
if (msecs == 0)
msecs = 1;
persec = (xfr->nbytes * 1000) / msecs;
xfrin_log(xfr, ISC_LOG_INFO,
"Transfer completed: %d messages, %d records, "
"%" PRIu64 " bytes, "
"%u.%03u secs (%u bytes/sec)",
xfr->nmsg, xfr->nrecs, xfr->nbytes,
(unsigned int) (msecs / 1000), (unsigned int) (msecs % 1000),
(unsigned int) persec);