<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;">
Hi Mark,
<div><br>
</div>
<div>Yes, that’s what I see in the default log but when looking into rpz.log I see the query and RPZ rewrites</div>
<div><br>
</div>
<div>rpz: info: client @0x7f033dd7f000 MyHiddenMaster#56341 (ads.pubmatic.com): rpz QNAME NODATA rewrite ads.pubmatic.com/HTTPS/IN via ads.pubmatic.com.rpz.f1-<a href="http://online.net">online.net</a></div>
<div><br>
</div>
<div>Likewise <span style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">NXDOMAIN is mentioned here for RPZ and </span>dnstap</div>
<div>
<div style="display: block;">
<div style="-webkit-user-select: all; -webkit-user-drag: element; display: inline-block;" class="apple-rich-link" draggable="true" role="link" data-url="https://protodoc.io/isc-projects/bind9/dnstap">
<a style="border-radius:10px;font-family:-apple-system, Helvetica, Arial, sans-serif;display:block;-webkit-user-select:none;width:300px;user-select:none;-webkit-user-modify:read-only;user-modify:read-only;overflow:hidden;text-decoration:none;" class="lp-rich-link" rel="nofollow" href="https://protodoc.io/isc-projects/bind9/dnstap" dir="ltr" role="button" draggable="false" width="300">
<table style="table-layout:fixed;border-collapse:collapse;width:300px;background-color:#E5E6E9;font-family:-apple-system, Helvetica, Arial, sans-serif;" class="lp-rich-link-emailBaseTable" cellpadding="0" cellspacing="0" border="0" width="300">
<tbody>
<tr>
<td vertical-align="center">
<table bgcolor="#E5E6E9" cellpadding="0" cellspacing="0" width="300" style="table-layout:fixed;font-family:-apple-system, Helvetica, Arial, sans-serif;background-color:rgba(229, 230, 233, 1);" class="lp-rich-link-captionBar">
<tbody>
<tr>
<td style="padding:8px 0px 8px 0px;" class="lp-rich-link-captionBar-textStackItem">
<div style="max-width:100%;margin:0px 16px 0px 16px;overflow:hidden;" class="lp-rich-link-captionBar-textStack">
<div style="word-wrap:break-word;font-weight:500;font-size:12px;overflow:hidden;text-overflow:ellipsis;text-align:left;" class="lp-rich-link-captionBar-textStack-topCaption-leading">
<a rel="nofollow" href="https://protodoc.io/isc-projects/bind9/dnstap" style="text-decoration: none" draggable="false"><font color="#272727" style="color: rgba(0, 0, 0, 0.847059);">dnstap - isc-projects/bind9 - protodoc.io</font></a></div>
<div style="word-wrap:break-word;font-weight:400;font-size:11px;overflow:hidden;text-overflow:ellipsis;text-align:left;" class="lp-rich-link-captionBar-textStack-bottomCaption-leading">
<a rel="nofollow" href="https://protodoc.io/isc-projects/bind9/dnstap" style="text-decoration: none" draggable="false"><font color="#808080" style="color: rgba(0, 0, 0, 0.498039);">protodoc.io</font></a></div>
</div>
</td>
<td style="padding:0px 12px 0px 0px;" class="lp-rich-link-captionBar-rightIconItem" width="30">
<a rel="nofollow" href="https://protodoc.io/isc-projects/bind9/dnstap" draggable="false"><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAEgAAABICAQAAAD/5HvMAAANBGlDQ1BrQ0dDb2xvclNwYWNlR2VuZXJpY0dyYXlHYW1tYTJfMgAAWIWlVwdck9cWv9/IAJKwp4ywkWVAgQAyIjOA7CG4iEkggRBiBgLiQooVrFscOCoqilpcFYE6UYtW6satD2qpoNRiLS6svpsEEKvte+/3vvzud//fPefcc8495557A4DuRo5EIkIBAHliuTQikZU+KT2DTroHyMAYaAN3oM3hyiSs+PgYyALE+WI++OR5cQMgyv6am3KuT+n/+BB4fBkX9idhK+LJuHkAIOMBIJtxJVI5ABqT4LjtLLlEiUsgNshNTgyBeDnkoQzKKh+rCL6YLxVy6RFSThE9gpOXx6F7unvS46X5WULRZ6z+f588kWJYN2wUWW5SNOzdof1lPE6oEvtBfJDLCUuCmAlxb4EwNRbiYABQO4l8QiLEURDzFLkpLIhdIa7PkoanQBwI8R2BIlKJxwGAmRQLktMgNoM4Jjc/WilrA3GWeEZsnFoX9iVXFpIBsRPELQI+WxkzO4gfS/MTlTzOAOA0Hj80DGJoB84UytnJg7hcVpAUprYTv14sCIlV6yJQcjhR8RA7QOzAF0UkquchxEjk8co54TehQCyKjVH7RTjHl6n8hd9EslyQHAmxJ8TJcmlyotoeYnmWMJwNcTjEuwXSyES1v8Q+iUiVZ3BNSO4caViEek1IhVJFYoraR9J2vjhFOT/MEdIDkIpwAB/kgxnwzQVi0AnoQAaEoECFsgEH5MFGhxa4whYBucSwSSGHDOSqOKSga5g+JKGUcQMSSMsHWZBXBCWHxumAB2dQSypnyYdN+aWcuVs1xh3U6A5biOUOoIBfAtAL6QKIJoIO1UghtDAP9iFwVAFp2RCP1KKWj1dZq7aBPmh/z6CWfJUtnGG5D7aFQLoYFMMR2ZBvuDHOwMfC5o/H4AE4QyUlhRxFwE01Pl41NqT1g+dK33qGtc6Eto70fuSKDa3iKSglh98i6KF4cH1k0Jq3UCZ3UPovfi43UzhJJFVLE9jTatUjpdLpQu6lZX2tJUdNAP3GkpPnAX2vTtO5YRvp7XjjlGuU1pJ/iOqntn0c1biReaPKJN4neQN1Ea4SLhMeEK4DOux/JrQTuiG6S7gHf7eH7fkQA/XaDOWE2i4ugg3bwIKaRSpqHmxCFY9sOB4KiOXwnaWSdvtLLCI+8WgkPX9YezZs+X+1YTBj+Cr9nM+uz/+yQ0asZJZ4uZlEMq22ZIAvUa+HMnb8RbEvYkGpK2M/o5exnbGX8Zzx4EP8GDcZvzLaGVsh5Qm2CjuMHcOasGasDdDhVzN2CmtSob3YUfg78Dc7IvszO0KZYdzBHaCkygdzcOReGekza0Q0lPxDa5jzN/k9MoeUa/nfWTRyno8rCP/DLqXZ0jxoJJozzYvGoiE0a/jzpAVDZEuzocXQjCE1kuZIC6WNGpF36oiJBjNI+FE9UFucDqlDmSZWVSMO5FRycAb9/auP9I+8VHomHJkbCBXmhnBEDflc7aJ/tNdSoKwQzFLJy1TVQaySk3yU3zJV1YIjyGRVDD9jG9GP6EgMIzp+0EMMJUYSw2HvoRwnjiFGQeyr5MItcQ+cDatbHKDjLNwLDx7E6oo3VPNUUcWDIDUQD8WZyhr50U7g/kdPR+5CeNeQ8wvlyotBSL6kSCrMFsjpLHgz4tPZYq67K92T4QFPROU9S319eJ6guj8hRm1chbRAPYYrXwSgCe9gBsAUWAJbeKq7QV0+wB+es2HwjIwDyTCy06B1AmiNFK5tCVgAykElWA7WgA1gC9gO6kA9OAiOgKOwKn8PLoDLoB3chSdQF3gC+sALMIAgCAmhIvqIKWKF2CMuiCfCRAKRMCQGSUTSkUwkGxEjCqQEWYhUIiuRDchWpA45gDQhp5DzyBXkNtKJ9CC/I29QDKWgBqgF6oCOQZkoC41Gk9GpaDY6Ey1Gy9Cl6Dq0Bt2LNqCn0AtoO9qBPkH7MYBpYUaYNeaGMbEQLA7LwLIwKTYXq8CqsBqsHlaBVuwa1oH1Yq9xIq6P03E3GJtIPAXn4jPxufgSfAO+C2/Az+DX8E68D39HoBLMCS4EPwKbMImQTZhFKCdUEWoJhwlnYdXuIrwgEolGMC98YL6kE3OIs4lLiJuI+4gniVeID4n9JBLJlORCCiDFkTgkOamctJ60l3SCdJXURXpF1iJbkT3J4eQMsphcSq4i7yYfJ18lPyIPaOho2Gv4acRp8DSKNJZpbNdo1rik0aUxoKmr6agZoJmsmaO5QHOdZr3mWc17ms+1tLRstHy1ErSEWvO11mnt1zqn1an1mqJHcaaEUKZQFJSllJ2Uk5TblOdUKtWBGkzNoMqpS6l11NPUB9RXNH2aO41N49Hm0appDbSrtKfaGtr22iztadrF2lXah7QvaffqaOg46ITocHTm6lTrNOnc1OnX1df10I3TzdNdortb97xutx5Jz0EvTI+nV6a3Te+03kN9TN9WP0Sfq79Qf7v+Wf0uA6KBowHbIMeg0uAbg4sGfYZ6huMMUw0LDasNjxl2GGFGDkZsI5HRMqODRjeM3hhbGLOM+caLjeuNrxq/NBllEmzCN6kw2WfSbvLGlG4aZpprusL0iOl9M9zM2SzBbJbZZrOzZr2jDEb5j+KOqhh1cNQdc9Tc2TzRfLb5NvM2834LS4sIC4nFeovTFr2WRpbBljmWqy2PW/ZY6VsFWgmtVludsHpMN6Sz6CL6OvoZep+1uXWktcJ6q/VF6wEbR5sUm1KbfTb3bTVtmbZZtqttW2z77KzsJtqV2O2xu2OvYc+0F9ivtW+1f+ng6JDmsMjhiEO3o4kj27HYcY/jPSeqU5DTTKcap+ujiaOZo3NHbxp92Rl19nIWOFc7X3JBXbxdhC6bXK64Elx9XcWuNa433ShuLLcCtz1une5G7jHupe5H3J+OsRuTMWbFmNYx7xheDBE83+566HlEeZR6NHv87unsyfWs9rw+ljo2fOy8sY1jn41zGccft3ncLS99r4lei7xavP709vGWetd79/jY+WT6bPS5yTRgxjOXMM/5Enwn+M7zPer72s/bT+530O83fzf/XP/d/t3jHcfzx28f/zDAJoATsDWgI5AemBn4dWBHkHUQJ6gm6Kdg22BecG3wI9ZoVg5rL+vpBMYE6YTDE16G+IXMCTkZioVGhFaEXgzTC0sJ2xD2INwmPDt8T3hfhFfE7IiTkYTI6MgVkTfZFmwuu47dF+UTNSfqTDQlOil6Q/RPMc4x0pjmiejEqImrJt6LtY8Vxx6JA3HsuFVx9+Md42fGf5dATIhPqE74JdEjsSSxNUk/aXrS7qQXyROSlyXfTXFKUaS0pGqnTkmtS32ZFpq2Mq1j0phJcyZdSDdLF6Y3ZpAyUjNqM/onh01eM7lriteU8ik3pjpOLZx6fprZNNG0Y9O1p3OmH8okZKZl7s58y4nj1HD6Z7BnbJzRxw3hruU+4QXzVvN6+AH8lfxHWQFZK7O6swOyV2X3CIIEVYJeYYhwg/BZTmTOlpyXuXG5O3Pfi9JE+/LIeZl5TWI9ca74TL5lfmH+FYmLpFzSMdNv5pqZfdJoaa0MkU2VNcoN4J/SNoWT4gtFZ0FgQXXBq1mpsw4V6haKC9uKnIsWFz0qDi/eMRufzZ3dUmJdsqCkcw5rzta5yNwZc1vm2c4rm9c1P2L+rgWaC3IX/FjKKF1Z+sfCtIXNZRZl88sefhHxxZ5yWrm0/OYi/0VbvsS/FH55cfHYxesXv6vgVfxQyaisqny7hLvkh688vlr31fulWUsvLvNetnk5cbl4+Y0VQSt2rdRdWbzy4aqJqxpW01dXrP5jzfQ156vGVW1Zq7lWsbZjXcy6xvV265evf7tBsKG9ekL1vo3mGxdvfLmJt+nq5uDN9VsstlRuefO18OtbWyO2NtQ41FRtI24r2PbL9tTtrTuYO+pqzWora//cKd7ZsStx15k6n7q63ea7l+1B9yj29OydsvfyN6HfNNa71W/dZ7Svcj/Yr9j/+EDmgRsHow+2HGIeqv/W/tuNh/UPVzQgDUUNfUcERzoa0xuvNEU1tTT7Nx/+zv27nUetj1YfMzy27Ljm8bLj708Un+g/KTnZeyr71MOW6S13T086ff1MwpmLZ6PPnvs+/PvTrazWE+cCzh0973e+6QfmD0cueF9oaPNqO/yj14+HL3pfbLjkc6nxsu/l5ivjrxy/GnT11LXQa99fZ1+/0B7bfuVGyo1bN6fc7LjFu9V9W3T72Z2COwN358OLfcV9nftVD8wf1Pxr9L/2dXh3HOsM7Wz7Kemnuw+5D5/8LPv5bVfZL9Rfqh5ZParr9uw+2hPec/nx5MddTyRPBnrLf9X9deNTp6ff/hb8W1vfpL6uZ9Jn739f8tz0+c4/xv3R0h/f/+BF3ouBlxWvTF/tes183fom7c2jgVlvSW/X/Tn6z+Z30e/uvc97//7fCQ/4Yk7kYoUAAAA4ZVhJZk1NACoAAAAIAAGHaQAEAAAAAQAAABoAAAAAAAKgAgAEAAAAAQAAAEigAwAEAAAAAQAAAEgAAAAAs/lk1QAAB7NJREFUaAXtWd+LVVUU/ubeuTNNWmKRoD45gpEZlKCixNRQEmkiTCEKvuT0BxQSvUQp9BYlvfWQCQWNNgSZoGMq/gqhlwgM0R4SXxQtxhwdx2l+nL5vrbPnnHvvuXfuj/Ht7sM95+x91v72t9dee6299wVaqaWBlgZaGmhpoEgDbUW5RjJt8AuI4qsRlJk6jRNqQzvypDDFK4rx2liSJ8EpTM6UzTT1MF/a0UU61dLsEhVq16+hdhQwZmgFPM2rG4uxAPNYMoo7uIG/cIXXhEl08TlZoeUKxfUS6orJbMAmvIiVeCoD929cwi84igsxKaefIdhsUTs6DaIPR3AvNuAJ6mWUJP3S+0T85R6l+ky+c5bhbZCXk1nPnvtsGsVI/BZmV/IcITHPHcX6mFSNzdY6ZD5Un2A3HiHyXXSYtu7iN/xBq7lFAqAdLaJFrcJqPMbcOP6z5wN8hg+ZD4PN1+bTo4R4Eies1/fj3p9EP1aQWGnqYGk/TprsKO7b8wRrA0KZkySg5Zw5GoS7dh/Cy8ilsNuYy9H/JClHiaFUjStEmCNKXQRajmsEnzLdDGP7TLtyg3mj4t46Z/n8zPftGGa9UXOd14yS0JpKMuUncJmwk5xJEc5hieHJJ6c1UtxI8nUJzrLWmHnuy0RCPFOL5WvOuTc+Tsgpo3PQamqAKpNJwKUvpYNGSQHmuOWr+3gTqXSTfvYQSGqPMGBi1TSTxtFQIqY0ECNERGtCRxrvNUZFpnyGudCAvVa5ycSVFszInCGCUEaJKBfQQHJ1HyGIpu4/jFi10JFxe1qL7+mJvmRGQ7SYCI50xD4nhu/SNdzViy2Ytl5F2MZcdcsJqyJBr8dPrKdr2Byp9LUtRpomagM6csM7TJA7/B1VK/Ew2GvJLW3mPTjGGhG7ongnDbk1wYKO0A5bbW+hBKhyVvpZZ9HqASF6mEsGo7hWMsWBjfiZ0nIR4+Z7Ii5PvCMayB5+EdoIkevUURvXPMBeVtbsOpGaLywuSskwborDxQQb1UCr6f2UdWvRPWfBR4h7mSvMWFsRYHZGdAo4zaqK6LtMKBhruobPpQK2mmxEIx4zMhowkVpFYZfx2rtixNPWYbVSY1JEfxY3WV2UVjCXNSu8qT4uxiQXgq7e5ZsjfMN6STeEsMI6GHF1IKpqpcYkh9hHSC22zlhELyfkdPZRQs1LH9Ox3civK/88UYoJdRDNUd/kN7VSlhy2uFi7BnBlAw4BcNHuxRJqSDuNrXiXpMfYV+U116ZNcJzvA/i9tBKRLrJMqMv4m6JUWapMyIMocNXqhI1OAMiRQI50QEJdGMRmvIEfmBOlyPr+OXNO2+s4gqPBQnQmIRcuvvvw7CewfPROAy7ui7uAzfw6zp/HOGEMMjdtM3PQINO1vM5OSghV8y/TMrM1JGFtbJS0OE0Dq8x7/h7fCiTwNZ8LeQEH2JT8ErCPv7R+mDUUoSnNt3spLguzCJmsVfe30rs3tBGv0HraYqsJblP5TgaOC6yU0VwpVHk+i5CP9r1YWJoqtSDld1t5xND5Nt+GecHeNCFK7YdFTKoV9O7opbgUyIooUrtimEMssqeMOJ168BoDRBf1kccOfjjA3zt4iwM8j7HsLHM5m6tJHdelo8HQS4fUZLMJ5dnYjRhrmT0T9TvMByydZHfypJQjpW3sRM7ouH6CA4hB+HAERwOusyRfQjmRLXuTD63kGAW8gfqaJBX3yu4Gp+M960eGVm4KMnV3jDoZ0Z420zFa7bLbbKHjR0IqOPilia5QGnHz/KphldPxKR5Cx00GprpCR3Fw7bdGXOVqai2bDvqZolfR8l2rnJdMLnvmeu1+yilc1x1cdRiVLD9OmnNwdylCcn/SiHYiPmyD8Q5eZLK04/rJ2QKloeWHL5+SBVovaaiPIrWaVLS48FWP/LSWW0rppZqXhLt7qd64Iw0s0II7CEvYIUP23n9H2HAYM0B6ntKL2EAjebrWhliz4SWs6yhZ5MvXSD/zLRLJZr61NY0aDV5a71nJv+9gHQ1Xg4t8bx6cNz6fbmMp25JlfYF/8RWesZbVlJtrFpFQpo4sxe0YqeFtkOso2SiejymE6VrJfAON8BQd4DzpNLlRFIxc18eEcmUfUpFpKWxsrKDKzSM/cChGiIhWl0MsxfbAon2WHzY4pdp0k5i56IyZtzpmDThqaVs15qWjhTxVDccx582Wqk1xAScOYKkNlh/HXLI1Ux0BI5ujtozdqQOr2xbdXXa2A6sdZsrhwKqblYTWdNKRXrdpKTnS6y3yyBqeZMuoBnPoLTrSu2Sbhjk9ZVwY79nHzJtEOFXh0LPTDj1PcZA1FTwEH7PBqonO7F7EFeyHunvwvp2ljnD+yRayjoWfwwvxsfA4HqfMfXyKPXzO6bEw8eLVyxq6Sg+otRycT1NaB1Shtr3O3S38tbCFSw0tInRNUAM6jdZfC3ob5cLEv4xQSidBIlPHRK91yEK3guLX4XWuf1by7L483eIEOMfToF/tU6hRLpdZUi8hxbgOakOpQPPV31NLUn9PXbe/p/6k5pS6uG3WLuShJ/09V/0wpUCJOgYqYVy/hkJd/4tTew8tYT3JQzf5F2fjhBJiYRHixhzIhe+tZ0sDLQ20NNDSQHMa+B/RZ9GmHnkbIQAAAABJRU5ErkJggg==" draggable="false" style="pointer-events:none !important;display:inline-block;width:30px;height:30px;" class="lp-rich-link-captionBar-rightIcon" width="30" height="30"></a></td>
</tr>
</tbody>
</table>
</td>
</tr>
</tbody>
</table>
</a></div>
</div>
<br>
</div>
<div>So I wonder if I am doing something wrong or missing something from a configuration point of view to get the RPZ infos I see in the logs somehow exported via dnstap ?</div>
<div><br>
</div>
<div>Thank you,</div>
<div>Wolfgang<br>
<div><br>
<blockquote type="cite">
<div>On 13. Sep 2025, at 07:50, Mark Andrews <marka@isc.org> wrote:</div>
<br class="Apple-interchange-newline">
<div>
<div dir="auto">
<div dir="ltr">NODATA is a concept not a record type. It indicates that the name is correct but there are no records of the requested type.
<div>
<div dir="ltr">--
<div>Mark Andrews</div>
</div>
<div dir="ltr"><br>
<blockquote type="cite">El 12 sept 2025, a las 0:34, Wolfgang Riedel via bind-users <bind-users@lists.isc.org> escribió:<br>
<br>
</blockquote>
</div>
<blockquote type="cite">
<div dir="ltr">
<div>Hi Folks,</div>
<div><br>
</div>
<div>I just wonder if I am missing something ;-)</div>
<div><br>
</div>
<div>I am currently running a POC for RPC Logging into Elasticsearch and just wonder why I can’t see any "<font><span style="caret-color: rgb(0, 0, 0);">rpz QNAME NODATA” in Elasticsearch?</span></font></div>
<div><br>
</div>
<div>I am running BIND 9.20.12 as recursive resolvers -> dnstap -> DNS-collector -> Elasticsearch</div>
<div><br>
</div>
<div>BIND:</div>
<div>
<div style="background-color: rgb(255, 255, 255); line-height: 18px;">
<div style="color: rgb(54, 87, 99); font-family: Menlo, Monaco, "Courier New", monospace; font-size: 12px; white-space: pre;">
dnstap <span style="color: rgb(74, 138, 201);">{ all; }</span>;</div>
<div style="color: rgb(54, 87, 99); font-family: Menlo, Monaco, "Courier New", monospace; font-size: 12px; white-space: pre;">
// dnstap <span style="color: rgb(74, 138, 201);">{ auth; resolver query; resolver response; }</span>;</div>
<br>
<div style="color: rgb(54, 87, 99); font-family: Menlo, Monaco, "Courier New", monospace; font-size: 12px; white-space: pre;">
/* where to capture to: file or unix <span style="color: rgb(74, 138, 201);">(socket)</span> */</div>
<div style="color: rgb(54, 87, 99); font-family: Menlo, Monaco, "Courier New", monospace; font-size: 12px; white-space: pre;">
// dnstap-output file <span style="color: rgb(99, 204, 204);">"</span><span style="color: rgb(71, 129, 65);">/tmp/named.tap</span><span style="color: rgb(99, 204, 204);">"</span>;</div>
<div style="color: rgb(54, 87, 99); font-family: Menlo, Monaco, "Courier New", monospace; font-size: 12px; white-space: pre;">
dnstap-output unix <span style="color: rgb(99, 204, 204);">"</span><span style="color: rgb(71, 129, 65);">/run/named/dnstap.sock</span><span style="color: rgb(99, 204, 204);">"</span>;</div>
<div><font color="#365763" face="Menlo, Monaco, Courier New, monospace"><span style="font-size: 12px; white-space: pre;">dnstap-identity
</span></font><font color="#63cccc" face="Menlo, Monaco, Courier New, monospace"><span style="caret-color: rgb(99, 204, 204); font-size: 12px; white-space: pre;">“</span></font><span style="color: rgb(71, 129, 65); font-family: Menlo, Monaco, "Courier New", monospace; font-size: 12px; white-space: pre;">rr1.xyz.net</span><font color="#63cccc" face="Menlo, Monaco, Courier New, monospace"><span style="caret-color: rgb(99, 204, 204); font-size: 12px; white-space: pre;">”</span></font><font color="#365763" face="Menlo, Monaco, Courier New, monospace"><span style="font-size: 12px; white-space: pre;">;</span></font></div>
<div><font color="#365763" face="Menlo, Monaco, Courier New, monospace"><span style="font-size: 12px; white-space: pre;"><br>
</span></font></div>
<div>
<div style="color: rgb(54, 87, 99); font-family: Menlo, Monaco, "Courier New", monospace; font-size: 12px; line-height: 18px; white-space: pre;">
<div>channel rpz_file {</div>
<div>file <span style="color: rgb(99, 204, 204);">"</span><span style="color: rgb(71, 129, 65);">/var/log/named/rpz.log</span><span style="color: rgb(99, 204, 204);">"</span> versions
<span style="color: rgb(196, 66, 0);">10</span> size <span style="color: rgb(196, 66, 0);">
10</span>m;</div>
<div>severity dynamic;</div>
<div>print-time yes;</div>
<div>print-category yes;</div>
<div>print-severity yes;</div>
<div>};</div>
</div>
</div>
</div>
</div>
<div><br>
</div>
<div>I am seeing a lot of "rpz QNAME NODATA rewrite” messages in /var/log/named/rpz.log and would like to export them via dnstap instead of local log files and them shipping them to elastic search via a log shipper.</div>
<div><br>
</div>
<div><br>
</div>
<div>DNSCollector:</div>
<div><br>
</div>
<div>
<div style="background-color: rgb(255, 255, 255); line-height: 18px;">
<div style="color: rgb(54, 87, 99); font-family: Menlo, Monaco, "Courier New", monospace; font-size: 12px; white-space: pre;">
<span style="color: rgb(71, 129, 65);">pipelines:</span></div>
<div style="color: rgb(54, 87, 99); font-family: Menlo, Monaco, "Courier New", monospace; font-size: 12px; white-space: pre;">
<span style="color: rgb(71, 129, 65);">- name: "input-bind-dnstap"</span></div>
<div style="color: rgb(54, 87, 99); font-family: Menlo, Monaco, "Courier New", monospace; font-size: 12px; white-space: pre;">
<span style="color: rgb(71, 129, 65);"># Read DNSTap stream from a UNIX socket</span></div>
<div style="color: rgb(54, 87, 99); font-family: Menlo, Monaco, "Courier New", monospace; font-size: 12px; white-space: pre;">
<span style="color: rgb(71, 129, 65);">dnstap:</span></div>
<div style="color: rgb(54, 87, 99); font-family: Menlo, Monaco, "Courier New", monospace; font-size: 12px; white-space: pre;">
<span style="color: rgb(71, 129, 65);">sock-path: /run/named/dnstap.sock</span></div>
<div style="color: rgb(54, 87, 99); font-family: Menlo, Monaco, "Courier New", monospace; font-size: 12px; white-space: pre;">
<span style="color: rgb(71, 129, 65);">sock-rcvbuf: 0</span></div>
<div style="color: rgb(54, 87, 99); font-family: Menlo, Monaco, "Courier New", monospace; font-size: 12px; white-space: pre;">
<span style="color: rgb(71, 129, 65);">routing-policy:</span></div>
<div style="color: rgb(54, 87, 99); font-family: Menlo, Monaco, "Courier New", monospace; font-size: 12px; white-space: pre;">
<span style="color: rgb(71, 129, 65);"># Routes DNS messages from the Unix socket to Elasticsearch</span></div>
<div style="color: rgb(54, 87, 99); font-family: Menlo, Monaco, "Courier New", monospace; font-size: 12px; white-space: pre;">
<span style="color: rgb(71, 129, 65);">forward: [output-elastic]</span></div>
<div style="color: rgb(54, 87, 99); font-family: Menlo, Monaco, "Courier New", monospace; font-size: 12px; white-space: pre;">
<span style="color: rgb(71, 129, 65);">dropped: [output-error-log]</span></div>
<br>
<div style="color: rgb(54, 87, 99); font-family: Menlo, Monaco, "Courier New", monospace; font-size: 12px; white-space: pre;">
<span style="color: rgb(71, 129, 65);">- name: "output-elastic"</span></div>
<div style="color: rgb(54, 87, 99); font-family: Menlo, Monaco, "Courier New", monospace; font-size: 12px; white-space: pre;">
<span style="color: rgb(71, 129, 65);">elasticsearch:</span></div>
<div style="color: rgb(54, 87, 99); font-family: Menlo, Monaco, "Courier New", monospace; font-size: 12px; white-space: pre;">
<span style="color: rgb(71, 129, 65);">server: "https://k8s-eck.xyz.net:30200"</span></div>
<div style="color: rgb(54, 87, 99); font-family: Menlo, Monaco, "Courier New", monospace; font-size: 12px; white-space: pre;">
<span style="color: rgb(71, 129, 65);">index: "logs-network_traffic.dnscollector-default"</span></div>
<div style="color: rgb(54, 87, 99); font-family: Menlo, Monaco, "Courier New", monospace; font-size: 12px; white-space: pre;">
<span style="color: rgb(71, 129, 65);">bulk-size: 1048576 # 1MB</span></div>
<div style="color: rgb(54, 87, 99); font-family: Menlo, Monaco, "Courier New", monospace; font-size: 12px; white-space: pre;">
<span style="color: rgb(71, 129, 65);">bulk-channel-size: 10</span></div>
<div style="color: rgb(54, 87, 99); font-family: Menlo, Monaco, "Courier New", monospace; font-size: 12px; white-space: pre;">
<span style="color: rgb(71, 129, 65);"># bulk-size refers to the size of the batch of DNS messages sent to your Elasticsearch instance</span></div>
<div style="color: rgb(54, 87, 99); font-family: Menlo, Monaco, "Courier New", monospace; font-size: 12px; white-space: pre;">
<span style="color: rgb(71, 129, 65);"># bulk-channel-size defines the number of batches the DNS collector can hold in memory before dropping them</span></div>
<div style="color: rgb(54, 87, 99); font-family: Menlo, Monaco, "Courier New", monospace; font-size: 12px; white-space: pre;">
<span style="color: rgb(71, 129, 65);">flush-interval: 10 # in seconds</span></div>
<div style="color: rgb(54, 87, 99); font-family: Menlo, Monaco, "Courier New", monospace; font-size: 12px; white-space: pre;">
<span style="color: rgb(71, 129, 65);"># Interval in seconds before to flush the buffer. Set the maximum time interval before the buffer is flushed.</span></div>
<div style="color: rgb(54, 87, 99); font-family: Menlo, Monaco, "Courier New", monospace; font-size: 12px; white-space: pre;">
<span style="color: rgb(71, 129, 65);"># If the bulk batches reach this interval before reaching the maximum size, they will be sent to Elasticsearch.</span></div>
<div style="color: rgb(54, 87, 99); font-family: Menlo, Monaco, "Courier New", monospace; font-size: 12px; white-space: pre;">
<span style="color: rgb(71, 129, 65);">compression: none</span></div>
<div style="color: rgb(54, 87, 99); font-family: Menlo, Monaco, "Courier New", monospace; font-size: 12px; white-space: pre;">
<span style="color: rgb(71, 129, 65);">chan-buffer-size: 0</span></div>
<div style="color: rgb(54, 87, 99); font-family: Menlo, Monaco, "Courier New", monospace; font-size: 12px; white-space: pre;">
<span style="color: rgb(71, 129, 65);">basic-auth-enable: true</span></div>
<div><font color="#478141" face="Menlo, Monaco, Courier New, monospace"><span style="font-size: 12px; white-space: pre;">basic-auth-login:
</span><span style="caret-color: rgb(71, 129, 65); font-size: 12px; white-space: pre;">“</span><span style="font-size: 12px; white-space: pre;">aaa"</span></font></div>
<div><font color="#478141" face="Menlo, Monaco, Courier New, monospace"><span style="font-size: 12px; white-space: pre;">basic-auth-pwd:
</span><span style="caret-color: rgb(71, 129, 65); font-size: 12px; white-space: pre;">“</span><span style="font-size: 12px; white-space: pre;">bbb"</span></font></div>
</div>
</div>
<div><br>
</div>
<div>Elasticsearch:</div>
<div><br>
</div>
<div>In Elasticsearch I can see all kind of Resource Record types besides <span style="caret-color: rgb(0, 0, 0);">NODATA which is what I am looking for ;-)</span></div>
<div><span style="caret-color: rgb(0, 0, 0);"><br>
</span></div>
<div><font><span style="caret-color: rgb(0, 0, 0);">So I just wonder if BIND is not exporting NODATA if it’s a result of RPZ or I am missing something else?</span></font></div>
<br>
<div><span style="font-family: Consolas; font-size: 11px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; caret-color: rgb(0, 0, 0); float: none; display: inline !important;">—</span><br style="font-family: Consolas; font-size: 11px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; caret-color: rgb(0, 0, 0);">
<span style="font-family: Consolas; font-size: 11px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; caret-color: rgb(0, 0, 0); float: none; display: inline !important;">Thank
you,</span><br style="font-family: Consolas; font-size: 11px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; caret-color: rgb(0, 0, 0);">
<span style="font-family: Consolas; font-size: 11px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; caret-color: rgb(0, 0, 0); float: none; display: inline !important;">Wolfgang</span><br style="font-family: Consolas; font-size: 11px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; caret-color: rgb(0, 0, 0);">
<span style="font-family: Consolas; font-size: 11px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; caret-color: rgb(0, 0, 0); float: none; display: inline !important;">_____________________________________</span><span style="font-family: Consolas; font-size: 11px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; caret-color: rgb(0, 0, 0); float: none; display: inline !important;">_____________________________________</span><span style="font-family: Consolas; font-size: 11px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; caret-color: rgb(0, 0, 0); float: none; display: inline !important;">____________________</span><br style="font-family: Consolas; font-size: 11px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; caret-color: rgb(0, 0, 0);">
<span style="font-family: Consolas; font-size: 11px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; caret-color: rgb(0, 0, 0); float: none; display: inline !important;">Wolfgang
Riedel | Distinguished</span><span style="font-family: Consolas; font-size: 11px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; caret-color: rgb(0, 0, 0); float: none; display: inline !important;"> </span><span style="font-family: Consolas; font-size: 11px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; caret-color: rgb(0, 0, 0); float: none; display: inline !important;">Engineer
| CCIE #13804 | VCP #42559</span><br style="font-family: Consolas; font-size: 11px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; caret-color: rgb(0, 0, 0);">
<br>
</div>
<span>-- </span><br>
<span>Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list.</span><br>
</div>
</blockquote>
</div>
</div>
</div>
</div>
</blockquote>
</div>
<br>
</div>
</body>
</html>