dmachard / go-dnscollector

Ingesting, pipelining, and enhancing your DNS logs with usage indicators, security analysis, and additional metadata.
MIT License
203 stars 45 forks source link

How to DNSDIST Protobuf PowerDNS -> DNS TAP Relay ? #749

Open dtouzeau opened 3 months ago

dtouzeau commented 3 months ago

Got DnsDist that sends Protobuf PowerDNS to DNS Collector. Did not find how to transform Dnsdist pipeline to DNSTAP in order to use DNS TAP relay for remote logging

DNSDIST -> GO DNS Collector (pipeline Protobuf PowerDNS) -> DNSTAP client -> DNSTAP relay -> remote receiver. Non-working configuration


global:
  text-format: timestamp-rfc3339ns identity operation rcode queryip edns-csubnet queryport
    family protocol length-unit qname qtype latency
  text-format-delimiter: ' '
  text-format-boundary: '"'
  trace:
    verbose: true
    log-malformed: false
    filename: /var/log/dns-collector.trace
    max-size: 100
    max-backups: 2
  server-identity: dns-collector
  pid-file: /var/run/dns-collector.pid

pipelines:
- name: dnsdist-in
  transforms:
    latency:
      measure-latency: true
      queries-timeout: 2
      unanswered-queries: true
    normalize:
      qname-lowercase: true
  routing-policy:
    forward: [relay-out,out-file]
  powerdns:
    add-dns-payload: false
    chan-buffer-size: 65535
    listen-ip: 127.0.0.1
    listen-port: 4897
    reset-conn: true

- name: relay-out
  routing-policy:
  dnstapclient:
    buffer-size: 100
    chan-buffer-size: 65535
    compression: none
    connect-timeout: 5
    extended-support: false
    flush-interval: 30
    overwrite-identity: false
    remote-address: 192.168.3.46
    remote-port: 6000
    retry-interval: 10
    transport: tcp

- name: out-file
  routing-policy:
  logfile:
    compress: true
    compress-interval: 5
    file-path: /var/log/dns-queries.log
    max-files: 0
    max-size: 500
    mode: flat-json
dmachard commented 3 months ago

Can you try with add-dns-payload: true on your powerdns collector?