Today, I was trying to get the ‘bind9′ plugin to work, but it didn’t work out-of-the-box. So I debugged and I found out that the standard bind9 plugin does not consider ‘views’. My bind9 setup has an ‘internal’ as well as an ‘external’ view. In the bind9 query log, this adds a ‘view internal: ‘ for each line, so the plugin didn’t see it as a valid query line:

client 192.168.1.1#37242: view internal: query: www.apple.com IN A +

I changed the regexp and I archive it here in case anyone else (or future-me) wants to use this:

--- bind9.orig	2009-11-01 15:06:16.000000000 +0100
+++ bind9.new	2009-11-01 15:06:07.000000000 +0100
@@ -73,9 +73,9 @@
     open(Q,"< $QUERYLOG") or die "$!";
     while (<Q>) {
 	chomp;
-	if (/client \d+\.\d+.\d+.\d+\#\d+: query\: \S+ (\w+) (\w+)/) {
-	    if ($1 eq 'IN' and $2 !~ /^TYPE/) {
-		$IN{$2}++;
+	if (/client \d+\.\d+.\d+.\d+\#\d+: (view \w+: )?query\: \S+ (\w+) (\w+)/) {
+	    if ($2 eq 'IN' and $3 !~ /^TYPE/) {
+		$IN{$3}++;
 	    } else {
 		$OTHER++;
 	    }

By the way, I also found out that there is a program called 'munin-run' which can be used to run the plugin as munin would, this saves a lot of hassle with sudo and environment settings!