So, I have all the syslogs from my DNS named servers going into Splunk and I'm able to parse them. I'm not a DNS server admin, so I don't know the proper terms for each field so I can properly label them when I create the extractions. Can someone point me to a reference? I've been googling around for a few hours and not really found anything useful.
For example:
error (connection refused) resolving '10.10.10.10/PTR/A/AB': 192.168.1.1#53
error - is that the event, the message, the type, the what?
The message in the () is called the description, the event, the issue, the message?
The resolving ..... is the message, the status, the problem, the?
The IP at the end is the client IP or the upstream DNS or the what?
I'm assuming the 53 is the destination port
Or for these zone messages:
zone my.host.com/AB: notify from 10.10.10.10#32145: zone is up to date
my.host.com/AB is what?
notify from 10.10.10.10 is the receiving server? The destination server? Receiving zone? Destination zone?
Is that number the source port?
And the last, is that the status? the message?
I loaded the Splunk App for Unix and Linux, but that doesn't seem to be applying to correct labels. Is there another app I should use?
