Log Management
Relevant source files
The following files were used as context for generating this wiki page:
Introduction
Log management in the DNS Hardening project provides a comprehensive audit trail and real-time visibility into the security posture of the system's DNS configuration. It encompasses the recording of hardening operations, emergency restoration events, periodic status monitoring, and security compromise alerts. The system is designed to track state changes and potential security breaches, such as the unauthorized removal of the immutable flag from system configuration files.
The architecture utilizes specialized log files for different functional areas, ensuring that administrative actions and automated security checks are distinctly categorized. This structured approach allows developers and administrators to verify system integrity and troubleshoot failures efficiently through timestamped entries and detailed event descriptions.
Log Categories and Storage
The system categorizes logs based on the nature of the event—operational, monitoring, or security alerts. Most operational logs are stored in temporary directories with timestamps, while persistent monitoring and alert logs are kept in standard system log paths.
Operational Logs
Operational logs are generated during the execution of hardening and restoration scripts. These files capture the step-by-step progress of system modifications and backups.
| Log Type | File Path Pattern | Description |
|---|---|---|
| Hardening Log | /tmp/dns_harden_TIMESTAMP.log | Records initial hardening, backups, and immutable flag application. |
| Restoration Log | /tmp/dns_restore_TIMESTAMP.log | Records emergency restoration steps and service masking. |
Sources: CHANGELOG.md:36-37, scripts/dns_harden.sh:11, scripts/dns_restore.sh:16
Monitoring and Alert Logs
Persistent logs track the ongoing state of the DNS infrastructure and flag security compromises.
| Log Type | File Path | Purpose |
|---|---|---|
| Monitor Log | /var/log/dns_hardening_monitor.log | Logs state transitions (e.g., from HARDENED to COMPROMISED). |
| Alert Log | /var/log/dns_hardening_alerts.log | Logs critical security failures and service outages. |
Sources: MONITORING.md:46-48, scripts/dns_monitor.sh:6, scripts/dns_alert.sh:6
Monitoring Logic and Data Flow
The log management system utilizes a state-based approach for monitoring. The dns_monitor.sh script compares the current system state against a stored state file to determine if a log entry is required.
The diagram shows the logic used to minimize log noise by only recording events when the hardening status transitions between "HARDENED" and "COMPROMISED".
Sources: scripts/dns_monitor.sh:8-38
Security Alerting
Security alerts are high-priority log entries triggered by specific failure conditions. These are handled by dns_alert.sh and dns_tls_monitor.sh, which monitor for:
- Removal of the immutable flag from
/etc/resolv.conf. - Modification of nameserver priority (ensuring
127.0.0.1remains primary). - Failure of the Unbound service.
- Absence of DNS over TLS (DoT) connections on port 853.
Alerts are directed to both a persistent log file and, if available, the system's desktop notification service for immediate administrator awareness.
Sources: scripts/dns_alert.sh:8-33, scripts/dns_tls_monitor.sh:12-42
Log Content Structure
Log entries typically follow a standardized format to ensure readability and ease of parsing.
Example Monitor Log Format
Monitor logs include a timestamp, a visual indicator, and the nature of the state change:
[2026-02-06 14:23:45] ✗ DNS hardening COMPROMISED - immutable flag removed
Resolv.conf content: nameserver 8.8.8.8
Sources: MONITORING.md:54-56, scripts/dns_monitor.sh:31-32
Example Operational Log (Restore)
Restoration logs provide a chronological sequence of steps taken to recover DNS functionality:
log() {
echo -e "${GREEN}[$(date '+%H:%M:%S')] $1${NC}" | tee -a "$LOGFILE"
}
Sources: scripts/dns_restore.sh:20-22
Conclusion
Log management in the DNS Hardening project serves as a critical diagnostic and security layer. By separating temporary operational logs from persistent monitoring and alert logs, the system provides a clear narrative of both manual administrative changes and automated security enforcement. The use of state tracking and real-time alerting ensures that any compromise of the hardened configuration—particularly the removal of write protections—is immediately recorded and reported.