# SPDX-License-Identifier: AGPL-3.0-only
# A refused zone transfer, as BIND logs it — in its own security log
# (channel with `print-time yes`, no syslog prefix):
#   2026-08-14T14:05:29.166 security: error: client @0x7f9ae42a3c98 203.0.113.9#62834 (example.org): zone transfer 'example.org/AXFR/IN' denied
# or through syslog (`named[pid]: client @0x… 203.0.113.9#62834 (example.org): zone transfer 'example.org/AXFR/IN' denied`).
# The pattern keys on the client and the verdict, whatever came before
# them, so it reads either file. Category `dns`; the zone is captured
# (a facet: which zones the enumerators go for), the line's own time is
# not read.
parser: bind-transfer-denied
log: dns
prefilter: "zone transfer"
regex: "client @0x[0-9a-f]+ (?P<ip>[0-9a-fA-F.:]+)#\\d+ \\((?P<zone>[^)]*)\\): zone transfer '(?P<transfer>[^']*)' denied"
