Skip to content

Commit

Permalink
Move docs to Lua file.
Browse files Browse the repository at this point in the history
  • Loading branch information
nickchappell committed Jun 11, 2016
1 parent de8e6b5 commit f1c7e44
Show file tree
Hide file tree
Showing 2 changed files with 62 additions and 74 deletions.
59 changes: 3 additions & 56 deletions docs/source/config/decoders/bind_query_log.rst
Original file line number Diff line number Diff line change
Expand Up @@ -8,60 +8,7 @@ BIND Query Log Decoder
| Plugin Name: **SandboxDecoder**
| File Name: **lua_decoders/bind_query_log.lua**
Parses DNS query logs from the BIND DNS server.

**Note**: You must have the `print-time`, `print-severity` and `print-category` options all set to **yes** in the logging configuration section of your `named.conf` file:

.. code-block:: bash
channel query_log {
file "/var/log/named/named_query.log" versions 3 size 5m;
severity info;
print-time yes;
print-severity yes;
print-category yes;
};
Config:

- type (string, optional, default nil):
Sets the message 'Type' header to the specified value

*Example Heka Configuration*

.. code-block:: ini
[BindQueryLogInput]
type = "LogstreamerInput"
decoder = "BindQueryLogDecoder"
file_match = 'named_query.log'
log_directory = "/var/log/named"
[BindQueryLogDecoder]
type = "SandboxDecoder"
filename = "lua_decoders/bind_query_log.lua"
[BindQueryLogDecoder.config]
type = "bind.query"
*Example Heka Message*

2016/04/25 17:31:37
:Timestamp: 2016-04-26 00:31:37 +0000 UTC
:Type: bind_query
:Hostname: ns1.company.com
:Pid: 0
:Uuid: 09a83ad2-89c0-4a7d-adfc-0e225e1c1ad6
:Logger: bind_query_log_input
:Payload: 27-May-2015 21:06:49.246 queries: info: client 10.0.1.70#41242 (webserver.company.com): query: webserver.company.com IN A +E (10.0.1.71)
:EnvVersion:
:Severity: 7
:Fields:
| name:"QueryFlags" type:string value:["recursion requested","EDNS used"]
| name:"ClientIP" type:string value:"10.0.1.70" representation:"ipv4"
| name:"ServerRespondingIP" type:string value:"10.0.1.71" representation:"ipv4"
| name:"RecordType" type:string value:"A"
| name:"QueryName" type:string value:"webserver"
| name:"RecordClass" type:string value:"IN"
| name:"Timestamp" type:double value:1.432760809e+18
| name:"QueryDomain" type:string value:"company.com"
| name:"FullQuery" type:string value:"webserver.company.com"
.. include:: /../../sandbox/lua/decoders/bind_query_log.lua
:start-after: --[[
:end-before: --]]
77 changes: 59 additions & 18 deletions sandbox/lua/decoders/bind_query_log.lua
Original file line number Diff line number Diff line change
Expand Up @@ -2,24 +2,65 @@
-- License, v. 2.0. If a copy of the MPL was not distributed with this
-- file, You can obtain one at http://mozilla.org/MPL/2.0/.

--[[BIND query log Lua decoder script
BIND DNS query log decoder script for the Heka stream processor:
http://hekad.readthedocs.org/en/latest/
Sample BIND query log message, with the print-category, print-severity and print-time options
all set to 'yes' in the logging channel options in named.conf:
27-May-2015 21:06:49.246 queries: info: client 10.0.1.70#41242 (webserver.company.com): query: webserver.company.com IN A +E (10.0.1.71)
The things we want out of it are:
* The client IP
* The name that was queried
* The domain of the name that was queried
* The record type (A, MX, PTR, etc.)
* The address of the interface that BIND used for the reply
--[[
Parses DNS query logs from the BIND DNS server.
**Note**: You must have the `print-time`, `print-severity` and `print-category` options all set to **yes** in the logging configuration section of your `named.conf` file:
.. code-block:: bash
channel query_log {
file "/var/log/named/named_query.log" versions 3 size 5m;
severity info;
print-time yes;
print-severity yes;
print-category yes;
};
Config:
- type (string, optional, default nil):
Sets the message 'Type' header to the specified value
*Example Heka Configuration*
.. code-block:: ini
[BindQueryLogInput]
type = "LogstreamerInput"
decoder = "BindQueryLogDecoder"
file_match = 'named_query.log'
log_directory = "/var/log/named"
[BindQueryLogDecoder]
type = "SandboxDecoder"
filename = "lua_decoders/bind_query_log.lua"
[BindQueryLogDecoder.config]
type = "bind.query"
*Example Heka Message*
2016/04/25 17:31:37
:Timestamp: 2016-04-26 00:31:37 +0000 UTC
:Type: bind_query
:Hostname: ns1.company.com
:Pid: 0
:Uuid: 09a83ad2-89c0-4a7d-adfc-0e225e1c1ad6
:Logger: bind_query_log_input
:Payload: 27-May-2015 21:06:49.246 queries: info: client 10.0.1.70#41242 (webserver.company.com): query: webserver.company.com IN A +E (10.0.1.71)
:EnvVersion:
:Severity: 7
:Fields:
| name:"QueryFlags" type:string value:["recursion requested","EDNS used"]
| name:"ClientIP" type:string value:"10.0.1.70" representation:"ipv4"
| name:"ServerRespondingIP" type:string value:"10.0.1.71" representation:"ipv4"
| name:"RecordType" type:string value:"A"
| name:"QueryName" type:string value:"webserver"
| name:"RecordClass" type:string value:"IN"
| name:"Timestamp" type:double value:1.432760809e+18
| name:"QueryDomain" type:string value:"company.com"
| name:"FullQuery" type:string value:"webserver.company.com"
--]]

Expand Down

0 comments on commit f1c7e44

Please sign in to comment.