Dnstap (traffic collection)ΒΆ

The dnstap supports logging DNS requests and responses to a unix socket in dnstap format using fstrm framing library. This logging is useful if you need effectively log all DNS traffic.

The unix socket and the socket reader must be present before starting resolver instances. Also it needs appropriate filesystem permissions; the typical user and group for the resolver are called knot-resolver.

Tunables:

  • unix-socket: the unix socket file where dnstap messages will be sent

  • log-queries: if true queries from downstream in wire format will be logged

  • log-responses: if true responses to downstream in wire format will be logged

logging:
  dnstap:
    unix-socket: /tmp/dnstap.sock
    # by default log is enabled for all
    log-queries: true
    log-responses: true