| Subject: | improve logging of 5011 events |
From https://wiki.isc.org/bin/view/Main/RootKeyRollImprovements:
BIND should log all relevant events related to managed key rollovers, including:
- Detection of new keys
- Keys being added to the Trust Anchor set (i.e. after hold-time timer)
- Key deletions
Minimize logging of missing keys: IANA plan to temporarily publish the new KSK and leave it published for the RFC 5011 “add” hold-down time period (30 days) and then remove it from the zone again without revoking it. BIND will add the key to the list of trust anchors, and leave it there, but warns that there is a mismatch between the zone contents and the trust anchor list. Instead, this should be considered “business as usual” and not generate excessive warning messages.