topic Re: Retrieve Windows DNS Logs - best practices ? in Getting Data In

Retrieve Windows DNS Logs - best practices ?

GaetanVP — Tue, 25 Jul 2023 09:39:39 GMT

Hello Splunkers,

Whats is "the best practice" to ingest DNS logs inside a distributed Splunk environment. I hesitate between two possibilities (maybe there are others) :

- Install a UF on my DNS servers and simply monitor the path where my DNS logs are located and then forward the logs to my Splunk env.

- Or use the Stream App, which seems a little bit more complicated : https://docs.splunk.com/Documentation/StreamApp/8.1.1/DeployStreamApp/AboutSplunkStream

Let me know what you used / think about that,

Thanks a lot !

GaetanVP

Re: Retrieve Windows DNS Logs - best practices ?

jotne — Tue, 25 Jul 2023 10:20:58 GMT

We do UF on all our servers. To not make to more complicated we use the UF to monitor the DNS log files.

Re: Retrieve Windows DNS Logs - best practices ?

isoutamo — Tue, 25 Jul 2023 10:39:04 GMT

This also depends on your DNS system and query volumes. If you have some real dns server/appliances or just Windows DC node wit DNS enable.

Re: Retrieve Windows DNS Logs - best practices ?

GaetanVP — Tue, 25 Jul 2023 12:49:11 GMT

In case of Windows DC node with DNS enable you would go for classic UF installation and monitoring ?

Thanks

Re: Retrieve Windows DNS Logs - best practices ?

isoutamo — Tue, 25 Jul 2023 14:40:46 GMT

Yes it should work like this.

Personally I try to avoid windows dc dns, but that’s another story.