<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;">
<div>Hi Folks,</div>
<div><br>
</div>
<div>I just wonder if I am missing something ;-)</div>
<div><br>
</div>
<div>I am currently running a POC for RPC Logging into Elasticsearch and just wonder why I can’t see any "<font color="#000000"><span style="caret-color: rgb(0, 0, 0);">rpz QNAME NODATA” in Elasticsearch?</span></font></div>
<div><br>
</div>
<div>I am running BIND 9.20.12 as recursive resolvers -> dnstap -> DNS-collector -> Elasticsearch</div>
<div><br>
</div>
<div>BIND:</div>
<div>
<div style="background-color: rgb(255, 255, 255); line-height: 18px;">
<div style="color: rgb(54, 87, 99); font-family: Menlo, Monaco, "Courier New", monospace; font-size: 12px; white-space: pre;">
dnstap <span style="color: rgb(74, 138, 201);">{ all; }</span>;</div>
<div style="color: rgb(54, 87, 99); font-family: Menlo, Monaco, "Courier New", monospace; font-size: 12px; white-space: pre;">
// dnstap <span style="color: rgb(74, 138, 201);">{ auth; resolver query; resolver response; }</span>;</div>
<br>
<div style="color: rgb(54, 87, 99); font-family: Menlo, Monaco, "Courier New", monospace; font-size: 12px; white-space: pre;">
/* where to capture to: file or unix <span style="color: rgb(74, 138, 201);">(socket)</span> */</div>
<div style="color: rgb(54, 87, 99); font-family: Menlo, Monaco, "Courier New", monospace; font-size: 12px; white-space: pre;">
// dnstap-output file <span style="color: rgb(99, 204, 204);">"</span><span style="color: rgb(71, 129, 65);">/tmp/named.tap</span><span style="color: rgb(99, 204, 204);">"</span>;</div>
<div style="color: rgb(54, 87, 99); font-family: Menlo, Monaco, "Courier New", monospace; font-size: 12px; white-space: pre;">
dnstap-output unix <span style="color: rgb(99, 204, 204);">"</span><span style="color: rgb(71, 129, 65);">/run/named/dnstap.sock</span><span style="color: rgb(99, 204, 204);">"</span>;</div>
<div><font color="#365763" face="Menlo, Monaco, Courier New, monospace"><span style="font-size: 12px; white-space: pre;">dnstap-identity
</span></font><font color="#63cccc" face="Menlo, Monaco, Courier New, monospace"><span style="caret-color: rgb(99, 204, 204); font-size: 12px; white-space: pre;">“</span></font><span style="color: rgb(71, 129, 65); font-family: Menlo, Monaco, "Courier New", monospace; font-size: 12px; white-space: pre;">rr1.xyz.net</span><font color="#63cccc" face="Menlo, Monaco, Courier New, monospace"><span style="caret-color: rgb(99, 204, 204); font-size: 12px; white-space: pre;">”</span></font><font color="#365763" face="Menlo, Monaco, Courier New, monospace"><span style="font-size: 12px; white-space: pre;">;</span></font></div>
<div><font color="#365763" face="Menlo, Monaco, Courier New, monospace"><span style="font-size: 12px; white-space: pre;"><br>
</span></font></div>
<div>
<div style="color: rgb(54, 87, 99); font-family: Menlo, Monaco, "Courier New", monospace; font-size: 12px; line-height: 18px; white-space: pre;">
<div>channel rpz_file {</div>
<div>file <span style="color: rgb(99, 204, 204);">"</span><span style="color: rgb(71, 129, 65);">/var/log/named/rpz.log</span><span style="color: rgb(99, 204, 204);">"</span> versions
<span style="color: rgb(196, 66, 0);">10</span> size <span style="color: rgb(196, 66, 0);">
10</span>m;</div>
<div>severity dynamic;</div>
<div>print-time yes;</div>
<div>print-category yes;</div>
<div>print-severity yes;</div>
<div>};</div>
</div>
</div>
</div>
</div>
<div><br>
</div>
<div>I am seeing a lot of "rpz QNAME NODATA rewrite” messages in /var/log/named/rpz.log and would like to export them via dnstap instead of local log files and them shipping them to elastic search via a log shipper.</div>
<div><br>
</div>
<div><br>
</div>
<div>DNSCollector:</div>
<div><br>
</div>
<div>
<div style="background-color: rgb(255, 255, 255); line-height: 18px;">
<div style="color: rgb(54, 87, 99); font-family: Menlo, Monaco, "Courier New", monospace; font-size: 12px; white-space: pre;">
<span style="color: rgb(71, 129, 65);">pipelines:</span></div>
<div style="color: rgb(54, 87, 99); font-family: Menlo, Monaco, "Courier New", monospace; font-size: 12px; white-space: pre;">
<span style="color: rgb(71, 129, 65);">- name: "input-bind-dnstap"</span></div>
<div style="color: rgb(54, 87, 99); font-family: Menlo, Monaco, "Courier New", monospace; font-size: 12px; white-space: pre;">
<span style="color: rgb(71, 129, 65);"># Read DNSTap stream from a UNIX socket</span></div>
<div style="color: rgb(54, 87, 99); font-family: Menlo, Monaco, "Courier New", monospace; font-size: 12px; white-space: pre;">
<span style="color: rgb(71, 129, 65);">dnstap:</span></div>
<div style="color: rgb(54, 87, 99); font-family: Menlo, Monaco, "Courier New", monospace; font-size: 12px; white-space: pre;">
<span style="color: rgb(71, 129, 65);">sock-path: /run/named/dnstap.sock</span></div>
<div style="color: rgb(54, 87, 99); font-family: Menlo, Monaco, "Courier New", monospace; font-size: 12px; white-space: pre;">
<span style="color: rgb(71, 129, 65);">sock-rcvbuf: 0</span></div>
<div style="color: rgb(54, 87, 99); font-family: Menlo, Monaco, "Courier New", monospace; font-size: 12px; white-space: pre;">
<span style="color: rgb(71, 129, 65);">routing-policy:</span></div>
<div style="color: rgb(54, 87, 99); font-family: Menlo, Monaco, "Courier New", monospace; font-size: 12px; white-space: pre;">
<span style="color: rgb(71, 129, 65);"># Routes DNS messages from the Unix socket to Elasticsearch</span></div>
<div style="color: rgb(54, 87, 99); font-family: Menlo, Monaco, "Courier New", monospace; font-size: 12px; white-space: pre;">
<span style="color: rgb(71, 129, 65);">forward: [output-elastic]</span></div>
<div style="color: rgb(54, 87, 99); font-family: Menlo, Monaco, "Courier New", monospace; font-size: 12px; white-space: pre;">
<span style="color: rgb(71, 129, 65);">dropped: [output-error-log]</span></div>
<br>
<div style="color: rgb(54, 87, 99); font-family: Menlo, Monaco, "Courier New", monospace; font-size: 12px; white-space: pre;">
<span style="color: rgb(71, 129, 65);">- name: "output-elastic"</span></div>
<div style="color: rgb(54, 87, 99); font-family: Menlo, Monaco, "Courier New", monospace; font-size: 12px; white-space: pre;">
<span style="color: rgb(71, 129, 65);">elasticsearch:</span></div>
<div style="color: rgb(54, 87, 99); font-family: Menlo, Monaco, "Courier New", monospace; font-size: 12px; white-space: pre;">
<span style="color: rgb(71, 129, 65);">server: "https://k8s-eck.xyz.net:30200"</span></div>
<div style="color: rgb(54, 87, 99); font-family: Menlo, Monaco, "Courier New", monospace; font-size: 12px; white-space: pre;">
<span style="color: rgb(71, 129, 65);">index: "logs-network_traffic.dnscollector-default"</span></div>
<div style="color: rgb(54, 87, 99); font-family: Menlo, Monaco, "Courier New", monospace; font-size: 12px; white-space: pre;">
<span style="color: rgb(71, 129, 65);">bulk-size: 1048576 # 1MB</span></div>
<div style="color: rgb(54, 87, 99); font-family: Menlo, Monaco, "Courier New", monospace; font-size: 12px; white-space: pre;">
<span style="color: rgb(71, 129, 65);">bulk-channel-size: 10</span></div>
<div style="color: rgb(54, 87, 99); font-family: Menlo, Monaco, "Courier New", monospace; font-size: 12px; white-space: pre;">
<span style="color: rgb(71, 129, 65);"># bulk-size refers to the size of the batch of DNS messages sent to your Elasticsearch instance</span></div>
<div style="color: rgb(54, 87, 99); font-family: Menlo, Monaco, "Courier New", monospace; font-size: 12px; white-space: pre;">
<span style="color: rgb(71, 129, 65);"># bulk-channel-size defines the number of batches the DNS collector can hold in memory before dropping them</span></div>
<div style="color: rgb(54, 87, 99); font-family: Menlo, Monaco, "Courier New", monospace; font-size: 12px; white-space: pre;">
<span style="color: rgb(71, 129, 65);">flush-interval: 10 # in seconds</span></div>
<div style="color: rgb(54, 87, 99); font-family: Menlo, Monaco, "Courier New", monospace; font-size: 12px; white-space: pre;">
<span style="color: rgb(71, 129, 65);"># Interval in seconds before to flush the buffer. Set the maximum time interval before the buffer is flushed.</span></div>
<div style="color: rgb(54, 87, 99); font-family: Menlo, Monaco, "Courier New", monospace; font-size: 12px; white-space: pre;">
<span style="color: rgb(71, 129, 65);"># If the bulk batches reach this interval before reaching the maximum size, they will be sent to Elasticsearch.</span></div>
<div style="color: rgb(54, 87, 99); font-family: Menlo, Monaco, "Courier New", monospace; font-size: 12px; white-space: pre;">
<span style="color: rgb(71, 129, 65);">compression: none</span></div>
<div style="color: rgb(54, 87, 99); font-family: Menlo, Monaco, "Courier New", monospace; font-size: 12px; white-space: pre;">
<span style="color: rgb(71, 129, 65);">chan-buffer-size: 0</span></div>
<div style="color: rgb(54, 87, 99); font-family: Menlo, Monaco, "Courier New", monospace; font-size: 12px; white-space: pre;">
<span style="color: rgb(71, 129, 65);">basic-auth-enable: true</span></div>
<div><font color="#478141" face="Menlo, Monaco, Courier New, monospace"><span style="font-size: 12px; white-space: pre;">basic-auth-login:
</span><span style="caret-color: rgb(71, 129, 65); font-size: 12px; white-space: pre;">“</span><span style="font-size: 12px; white-space: pre;">aaa"</span></font></div>
<div><font color="#478141" face="Menlo, Monaco, Courier New, monospace"><span style="font-size: 12px; white-space: pre;">basic-auth-pwd:
</span><span style="caret-color: rgb(71, 129, 65); font-size: 12px; white-space: pre;">“</span><span style="font-size: 12px; white-space: pre;">bbb"</span></font></div>
</div>
</div>
<div><br>
</div>
<div>Elasticsearch:</div>
<div><br>
</div>
<div>In Elasticsearch I can see all kind of Resource Record types besides <span style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">NODATA which is what I am looking for ;-)</span></div>
<div><span style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);"><br>
</span></div>
<div><font color="#000000"><span style="caret-color: rgb(0, 0, 0);">So I just wonder if BIND is not exporting NODATA if it’s a result of RPZ or I am missing something else?</span></font></div>
<br>
<div><span style="font-family: Consolas; font-size: 11px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); float: none; display: inline !important;">—</span><br style="font-family: Consolas; font-size: 11px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">
<span style="font-family: Consolas; font-size: 11px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); float: none; display: inline !important;">Thank
you,</span><br style="font-family: Consolas; font-size: 11px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">
<span style="font-family: Consolas; font-size: 11px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); float: none; display: inline !important;">Wolfgang</span><br style="font-family: Consolas; font-size: 11px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">
<span style="font-family: Consolas; font-size: 11px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); float: none; display: inline !important;">_____________________________________</span><span style="font-family: Consolas; font-size: 11px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); float: none; display: inline !important;">_____________________________________</span><span style="font-family: Consolas; font-size: 11px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); float: none; display: inline !important;">____________________</span><br style="font-family: Consolas; font-size: 11px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">
<span style="font-family: Consolas; font-size: 11px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); float: none; display: inline !important;">Wolfgang
Riedel | Distinguished</span><span style="font-family: Consolas; font-size: 11px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); float: none; display: inline !important;"> </span><span style="font-family: Consolas; font-size: 11px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); float: none; display: inline !important;">Engineer
| CCIE #13804 | VCP #42559</span><br style="font-family: Consolas; font-size: 11px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">
<br>
</div>
</body>
</html>