Ingesting, pipelining, and enhancing your DNS logs with usage indicators, security analysis, and additional metadata.
DNS-collector
acts as a passive high speed ingestor with pipelining support for your DNS logs, written in Golang. It allows enhancing your DNS logs by adding metadata, extracting usage patterns, and facilitating security analysis. The DNS traffic can be collected and aggregated from simultaneously sources like DNStap streams, network interface or log files and relays it to multiple other listeners with some transformations on it (traffic filtering, user privacy, ...).
Additionally, DNS-collector also support
- Extended DNStap with TLS encryption, compression, and more metadata capabilities
- DNS protocol conversions (to plain text, JSON, and more... )
- DNS parser with Extension Mechanisms for DNS (EDNS) support
- IPv4/v6 defragmentation and TCP reassembly
- Nanoseconds in timestamps
NOTE: The code before version 1.x is considered beta quality and is subject to breaking changes.
DNStap
with tls
|tcp
|unix
transports support and proxifier
PowerDNS
streams with full supportDNSMessage
for internal DNS data structureTZSP
protocol supportPlain text
filesPCAP
or DNSTap
files by watching a directoryPrometheus
exporterStatsd
supportREST API
with swagger to search DNS domainsFluentd
InfluxDB
Loki
clientElasticSearch
Scalyr
Redis
publisherKafka
producerClickHouse
client (not yet production ready)
Download the latest release
binary and start the DNS-collector with the provided configuration file. The default configuration listens on tcp/6000
for a DNSTap stream and DNS logs are printed on standard output.
./go-dnscollector -config config.yml
If you prefer run it from docker, follow this guide.
The configuration of DNS-collector is done through a file named config.yml
. When the DNS-collector starts, it will look for the config.yml from the current working directory.
See the full configuration guide for more details.
Run the DNS-collector in dry mode to verify the configuration.
./go-dnscollector -config config.yml -test-config
INFO: 2023/12/24 14:43:29.043730 main - config OK!
The _examples
folder from documentation contains a number of various configurations to get you started with the DNS-collector in different ways.
The _integration
folder contains DNS-collector configuration
files and docker compose
examples for popular tools:
Tuning may be necessary to deal with a large traffic loads. Please refer to the performance tuning guide if needed.
See the development guide for more information on how to build it yourself.