All Apps and Add-ons

Windows DNS debug logs TA not using CIM fields?

Path Finder

I set up a test environment with a Windows 2012 R2 server with the DNS server role, and was able to successfully install TA-DNSServer-NT6 (as per the instructions at http://docs.splunk.com/Documentation/MSApp/1.1.2/MSInfra/DownloadandconfiguretheSplunkAdd-onsforWind... ).

However, I was very surprised to discover two things:

  • The DNS packet data (which contains the actual replies, such as the IP addresses a hostname resolved to in a A query) was not being parsed, and in fact generated "incomplete" alerts with each packet line as in this example:

alt text

  • The summary lines were being correctly parsed, but the corresponding CIM fields (http://docs.splunk.com/Documentation/CIM/4.2.0/User/NetworkResolutionDNS ) were not extracted. For example, a query for tag=dns came up empty even though there are DNS events and the Splunk App for Windows Infrastructure "DNS: Top Requested Queries" report is being populated. Here is an example:

alt text

For one, I would have expected to see tags with network, resolution and dns values as per the CIM documentation.

Can anyone else with a working installation of the DNS debug log collection confirm whether this field is populated for them? Did I make some mistake in the setup or is this a limitation of the app?

1 Solution

Path Finder

So it turns out that the latest available version of the app claims support to CIM 4.0. And the Network Resolution (DNS) data model didn't show up until CIM 4.1.0 was released around 6 months ago.

So apparently it's a documented current limitation of the app. Oh, well.

View solution in original post

Path Finder

That might be an alternative, yes. Just keep in mind it's not using the DNS debug logs though, instead it uses new DNS logging functionality Microsoft introduced in 2012r2.

0 Karma

Path Finder

Do you have a link for it? Might be helpful for people that read this thread later on.

0 Karma

Motivator

Bummer. I'd never seen a DNS record with a (null) value before, so discard the SEDCMD-win_dns = s/\(\d+\)/./g attribute from the props.conf. I wonder how Enterprise Security Suite reacts to these funky looking records in Windows DNS logs.

0 Karma

Path Finder

So it turns out that the latest available version of the app claims support to CIM 4.0. And the Network Resolution (DNS) data model didn't show up until CIM 4.1.0 was released around 6 months ago.

So apparently it's a documented current limitation of the app. Oh, well.

View solution in original post

Motivator

Perhaps time for someone to update the app ...

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!