Bind 9™ logs the same information as Bind 8™ (except whether the request was recursive or not) but in a different format. Bind 9.3 and later versions support a more elaborate log file format, which includes the recursive/non-recursive request indicator again.
We also support the new date format introduced in
            Bind9
            9.3 which also contains
            the year (15-Jul-2002).
          
Example 7.3. Sample Bind 9™ Query Log
print-severity and
            print-category were set to
            yes to obtain that log. Lire also
            accepts logs where those are turned off.
          
Feb 25 11:09:43.651 queries: info: client 10.0.0.3#1035: \
    query: 3.example.com.nl IN A -
Feb 25 11:09:48.739 queries: info: client 10.0.0.3#1035: \
    query: 3.example.com.nl IN A -
Feb 25 12:50:32.476 queries: info: client 10.0.0.3#1035: \
    query: 21.example.com.co.uk IN A -
Feb 25 12:50:34.110 queries: info: client 10.0.0.3#1035: \
    query: 22.example.com IN A -
          If you are running a pre-9.3 version of Bind 9™ and
            you are missing the recursive flag from Bind 8™, it is
            possible to add back that feature by patching Bind 9™.
            The following patch by by Wytze van der Raay will add a
            + or - after the
            query type to indicate whether the query was recursive
            or not. Lire will detect that the log file was made by
            a patched Bind 9™.
          
# patch bin/named/query.c to log recursive/non-recursive query indication
SRC=bin/named/query.c
if [ -f ${SRC}.org ]
then
    echo "Patched ${SRC} already in place"
else
    echo "Patch ${SRC} for recursive/non-recursive query indication"
    cp -p ${SRC} ${SRC}.org
    patch -p0 ${SRC} <<\!
--- bin/named/query.c.org       Mon Sep 24 22:57:48 2001
+++ bin/named/query.c   Tue Sep 25 09:55:21 2001
@@ -3272,7 +3272,8 @@
        dns_rdatatype_format(rdataset->type, typename, sizeof(typename));
        ns_client_log(client, NS_LOGCATEGORY_QUERIES, NS_LOGMODULE_QUERY,
-                     level, "query: %s %s %s", namebuf, classname, typename);
+                     level, "query: %s %s %s%s", namebuf, classname, typename,
+                     WANTRECURSION(client) ? "+" : "-");
 }
 void
!
fi