Monitoring Splunk

Windows DNS log file configuration - poor syntax for keeping history (Splunk)

gregboccard
New Member

Hello,

First, thanks for your help and time!!

In windows 2008, the DNS log is a txt file (dns.log) which is recreated with the same name if the size reach a configurable amount.

There is not more history than the size you actually put, let's say 200mo. Then if you need this log just after 200mo has been reach, you end up with opening the file which is a fresh new empty one (because it has just been recreated).

How can I change that behavior in order to keep a bit more history. (something like DHCP could be great: one log by day of the week recycling every week). I tried to put DNS%date%.log but not sure if possible.

My issue is with Splunk soft (which is collecting DNS log to database), it doesn't support the fact that the same file with the same name is recreating over and over. The log crash (the file disapeer) when using Splunk. Splunk keeps a "SHARE_DELETE" flag on the DNS.log which makes windows fail to create the file with the same name until Splunk release it. And Splunk do not release the file in time.

Is someone came through that issue?

Thanks for your help and good day!

Greg.

0 Karma

Mannyi31
Explorer

Check this link in order to see the possible fix action for this symptom:

http://godlessheathenmemoirs.blogspot.com/2011/08/gathering-detailed-dns-debug-logs-from.html

0 Karma
Get Updates on the Splunk Community!

Set Up More Secure Configurations in Splunk Enterprise With Config Assist

This blog post is part 3 of 4 of a series on Splunk Assist. Click the links below to see the other ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...

Enterprise Security Content Update (ESCU) v3.54.0

The Splunk Threat Research Team (STRT) recently released Enterprise Security Content Update (ESCU) v3.54.0 and ...