Getting Data In

What is the best way to collect DNS logs and queries with *nix?

Roberto-P
Explorer

Hi all,

I'm looking for the best method to collect DNS logs and specifically the DNS queries and answers logs.

I see there is a preliminary set up in named.conf to enable the logs of the queries an where to write them as:

options {
querylog yes;
}

and

logging {
channel querylog {
file "/var/log/dns.log";
severity debug 3;
};
};

Does this  the logs will be in dns.log file , and now what is the best method to ingest them into SPLUNK with the right format mapping? 

What is your experiences with Linux DNS service?

I'm collect events with Splunk Deployment server + Heavy Forwarder  -->Splunk  ES CLOUD .

Thank you.

R

 

Labels (2)
0 Karma

Roberto-P
Explorer

I find the "Splunk Add-on for ISC BIND" but is not clear to me if this add-on have to be installed un the Heavy Forwarder only and the server linux with bind have to run the Universal Forwarder for *NIX

thanks

 

0 Karma
Get Updates on the Splunk Community!

New Dates, New City: Save the Date for .conf25!

Wake up, babe! New .conf25 dates AND location just dropped!! That's right, this year, .conf25 is taking place ...

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...