config.yml

# If turned on, log some applications messages
trace:
  # debug informations
  verbose: true
  # log malformed packet
  log-malformed: false
  # filename is the file to write logs to.
  filename: ""
  # maximum size in megabytes of the log file it gets rotated
  max-size: 10
  # maximum number of old log files to retain
  max-backups: 10

# list of supported collectors
collectors:
  # dnstap standard
  dnstap:
    # to enable, set the enable to true
    enable: true
    # listen on ip
    listen-ip: 0.0.0.0
    # listening on port
    listen-port: 6000
    # unix socket path
    sock-path: null
    # tls support
    tls-support: false
    # certificate server file
    cert-file: ""
    # private key server file
    key-file: ""

  # dns traffic
  dns-sniffer:
    # to enable, set the enable to true
    enable: false
    # filter on source and destination port
    port: 53
    # if "" bind on all interfaces
    device: wlp2s0
    # capture dns queries
    capture-dns-queries: true
    # capture dns replies
    capture-dns-replies: true

  # read text file
  tail:
    # to enable, set the enable to true
    enable: false
    # file to follow
    file-path: null
    # Use the exact layout numbers described https://golang.org/src/time/format.go
    time-layout: "2006-01-02T15:04:05.999999999Z07:00"
    # regexp pattern for queries
    # example for unbound: "query: (?P<queryip>[^ ]*) (?P<domain>[^ ]*) (?P<qtype>[^ ]*)"
    pattern-query: "^(?P<timestamp>[^ ]*) (?P<identity>[^ ]*) (?P<qr>.*_QUERY) (?P<rcode>[^ ]*)
      (?P<queryip>[^ ]*) (?P<queryport>[^ ]*) (?P<family>[^ ]*) (?P<protocol>[^ ]*)
      (?P<length>[^ ]*)b (?P<domain>[^ ]*) (?P<qtype>[^ ]*) (?P<latency>[^ ]*)$"
    # regexp pattern for replies
    # example for unbound: "reply: (?P<queryip>[^ ]*) (?P<domain>[^ ]*) (?P<qtype>[^ ]*) IN (?P<rcode>[^ ]*) (?P<latency>[^ ]*)"
    pattern-reply: "^(?P<timestamp>[^ ]*) (?P<identity>[^ ]*) (?P<qr>.*_RESPONSE) (?P<rcode>[^ ]*)
      (?P<queryip>[^ ]*) (?P<queryport>[^ ]*) (?P<family>[^ ]*) (?P<protocol>[^ ]*) (?P<length>[^ ]*)b
      (?P<domain>[^ ]*) (?P<qtype>[^ ]*) (?P<latency>[^ ]*)$"

  # protobuf powerdns
  powerdns:
    # to enable, set the enable to true
    enable: false
    # listen on ip
    listen-ip: 0.0.0.0
    # listening on port
    listen-port: 6001

# settings for subprocessors
subprocessors:
  # this option can be useful to reduce the size of your dns logs
  quiet-text:
    #  AQ: AUTH_QUERY
    #  AR: AUTH_RESPONSE
    #  RQ: RESOLVER_QUERY
    #  RR: RESOLVER_RESPONSE
    #  CQ: CLIENT_QUERY
    #  CR: CLIENT_RESPONSE
    #  FQ: FORWARDER_QUERY
    #  FR: FORWARDER_RESPONSE
    #  SQ: STUB_QUERY
    #  SR: STUB_RESPONSE
    #  TQ: TOOL_QUERY
    #  TR: TOOL_RESPONSE
    dnstap: false
    #  Q: QUERY
    #  R: REPLY
    dns: false

  # Statistics engine to compute some metrics on dns usage observed
  statistics:
    # default number of items on top 
    top-max-items: 100
    # expected common qtype list, other will be considered as suspicious
    common-qtypes: [ "A", "AAAA", "CNAME", "TXT", "PTR", "NAPTR", "DNSKEY", "SRV", "SOA", "NS", "MX", "DS" ]
    # a length greater than this value will be considered as suspicious
    threshold-qname-len: 80
    # a size greater than this value will be considered as suspicious
    # value in bytes
    threshold-packet-len: 1000
    # threshold to set a domain considered as slow, value in second
    threshold-slow: 0.5
    # prometheus prefix
    prometheus-prefix: "dnscollector"
    
  # Use this option to protect user privacy
  user-privacy:
    # IP-Addresses are anonymities by zeroing the host-part of an address.
    anonymize-ip: false
    # Reduce Qname to second level only, for exemple mail.google.com be replaced by google.com
    minimaze-qname: false

  # Convert all domain to lowercase
  # Wwww.GooGlE.com will be equal to www.google.com
  qname-lowercase: true

  # The cache is used to compute latency between replies and queries 
  # This cache can be disabled if your dns server already add the latency in the dns packet
  # Disable this feature to improve performance
  cache:
    # enable or disable
    enable: true
    # Ttl in second, max time to keep the query record in memory
    query-timeout: 5

  # Server identity, if empty  the hostname is used
  # This settings is used in dnstap logger as dnstap-identity
  server-id: ""

  # filtering feature to ignore some specific qname
  # dns logs is not redirected to loggers if the filtering regexp matched
  filtering:
    # path file of the fqdn drop list, domains list must be a full qualified domain name
    drop-fqdn-file: ""
    # path file of the domain drop list, domains list can be a partial domain name with regexp expression
    drop-domain-file: ""
    # path file of the query IP drop list, one IP address or subnet per line
    drop-queryip-file: ""
    # path file of the query IP keep list, one IP address or subnet per line
    keep-queryip-file: ""
    # drop specific responses according to the return code (NOERROR, ...). This list is empty by default
    # Example to ignore NOERROR dns packets
    # drop-rcodes:
    #  - NOERROR
    drop-rcodes: []
    # forward received queries to configured loggers ?
    log-queries: true
    # forward received replies to configured loggers ?
    log-replies: true

  # geoip maxmind support, more information on https://www.maxmind.com/en/geoip-demo
  # this feature can be used to append additional informations like country, city, asn
  # according to the query ip
  geoip:
    # path file to your mmdb country database
    mmdb-country-file: ""
    # path file to your mmdb city database
    mmdb-city-file: ""
    # path file to your mmdb ASN database
    mmdb-asn-file: ""

  # specific the default text log format used on all loggers supporting this mode
  # all available directives:
  # - timestamp-rfc3339ns: timestamp rfc3339 format, with nano support
  # - timestamp-unixms: unix timestamp with ms support
  # - timestamp-unixus: unix timestamp with us support
  # - timestamp-unixns: unix timestamp with nano support
  # - localtime: local time
  # - identity: dnstap identity
  # - operation: dnstap operation
  # - opcode: dns opcode (integer)
  # - rcode: dns return code
  # - queryip: dns query ip
  # - queryport: dns query port
  # - responseip: dns response ip
  # - responseport: dns response port
  # - id: dns id
  # - family: ip protocol version INET or INET6
  # - protocol: protocol UDP, TCP
  # - length: the length of the query or reply
  # - qtype: dns qtype
  # - qname: dns qname
  # - latency: computed latency between queries and replies
  # - answercount: the number of answer
  # - continent: continent code
  # - country: country iso code
  # - city: city name
  # - as-number: autonomous system number
  # - as-owner: autonomous system organization
  # - ttl: answer ttl, only the first one value
  # - answer: rdata answer, only the first one, prefer to use the JSON format if you wamt all answers
  # - malformed: malformed dns packet, integer value 1/0
  # - qr: query or reply flag, string value Q/R
  # - tc: truncated flag
  # - aa: authoritative answer
  # - ra: recursion available
  # - ad: authenticated data
  # - edns-csubnet: client subnet
  text-format: "timestamp-rfc3339ns identity operation rcode queryip queryport family protocol length qname qtype latency"

# list of loggers
loggers:

  # print received dns traffic to sdtout
  stdout:
    # to enable, set the enable to true
    enable: true
    # output format: text|json
    mode: text
    # output text format, please refer to the default text format to see all available directives 
    # use this parameter if you want a specific format
    text-format: ""

  # rest api server
  webserver:
    # to enable, set the enable to true
    enable: true
    # listening IP
    listen-ip: 0.0.0.0
    # listening port
    listen-port: 8080
    # default login
    basic-auth-login: admin
    # default password
    basic-auth-pwd: changeme
    # tls support
    tls-support: false
    # certificate server file
    cert-file: ""
    # private key server file
    key-file: ""

  # prometheus metrics server
  prometheus:
    # to enable, set the enable to true
    enable: false
    # listening IP
    listen-ip: 0.0.0.0
    # listening port
    listen-port: 8081
    # default login
    basic-auth-login: admin
    # default password
    basic-auth-pwd: changeme
    # tls support
    tls-support: false
    # certificate server file
    cert-file: ""
    # private key server file
    key-file: ""
    # prometheus prefix
    prometheus-prefix: "dnscollector"

  # write captured dns traffic to text files with rotation and compression support
  logfile:
    # to enable, set the enable to true
    enable: false
    # output logfile name
    file-path:  /tmp/test.log
    # maximum size in megabytes of the file before rotation
    # A minimum of max-size*max-files megabytes of space disk must be available
    max-size: 100
    # maximum number of files to retain.
    # Set to zero if you want to disable this feature
    max-files: 10
    # flush buffer to log file every X seconds
    flush-interval: 10
    # compress log file
    compress: false
    # compress interval
    # checking every X seconds if new log files must be compressed
    compress-interval: 5
    # run external script after each file compress step 
    compress-postcommand: null
    # output format: text|json
    mode: text
    # output text format, please refer to the default text format to see all available directives 
    # use this parameter if you want a specific format
    text-format: ""
    # run external script after each file rotation
    postrotate-command: null
    # delete file on script success
    postrotate-delete-success: true

  # resend captured dns traffic to another dnstap collector or to unix socket
  dnstap:
    # to enable, set the enable to true
    enable: false
     # remote address
    remote-address: 10.0.0.1
    # remote tcp port
    remote-port: 6000
    # unix socket path
    sock-path: null
    # interval in second between retry reconnect
    retry-interval: 5
    # enable tls
    tls-support: false
    # insecure skip verify
    tls-insecure: false

  # resend captured dns traffic to a tcp remote destination or to unix socket
  tcpclient:
    # to enable, set the enable to true
    enable: false
    # network transport to use: tcp|unix
    transport: tcp
    # remote address
    remote-address: 127.0.0.1
    # remote tcp port
    remote-port: 9999
    # unix socket path
    sock-path: null
    # interval in second between retry reconnect
    retry-interval: 5
    # enable tls
    tls-support: false
    # insecure skip verify
    tls-insecure: false
    # output format: text|json
    mode: json
    # output text format, please refer to the default text format to see all available directives 
    # use this parameter if you want a specific format
    text-format: ""
    # delimiter to use between payload sent
    delimiter: "\n"

  # redirect captured dns traffic to a remote syslog server or local one
  syslog:
    # to enable, set the enable to true
    enable: false
    # Set the syslog logging severity 
    severity: INFO
    # Set the syslog logging facility 
    facility: DAEMON
    # Transport to use to a remote log daemon or local one
    # local|tcp|udp|unix or tcp+tls
    transport: local
    # Remote address host:port
    remote-address: ""
    # output text format, please refer to the default text format to see all available directives 
    # use this parameter if you want a specific format
    text-format: ""
    # output format: text|json
    mode: text
    # enable tls
    tls-support: false
    # insecure skip verify
    tls-insecure: false

  # resend captured dns traffic to a remote fluentd server or to unix socket
  fluentd:
    # to enable, set the enable to true
    enable: false
    # network transport to use: tcp|unix
    transport: tcp
    # remote address
    remote-address: 127.0.0.1
    # remote tcp port
    remote-port: 24224
    # unix socket path
    sock-path: null
    # interval in second between retry reconnect
    retry-interval: 5
    # tag name
    tag: "dns.collector"
    # enable tls
    tls-support: false
    # insecure skip verify
    tls-insecure: false

  # write captured dns traffic to network pcap file
  pcapfile:
    # to enable, set the enable to true
    enable: false
    # output logfile name
    file-path: null
    # maximum size in megabytes of the file before rotation
    max-size: 100
    # maximum number of files to retain.
    max-files: 10
    # compress pcap file
    compress: false
    # compress interval
    # checking every X seconds if new log files must be compressed
    compress-interval: 5
    # run external script after each file rotation
    postrotate-command: null
    # delete file on script success
    postrotate-delete-success: true

  # resend captured dns traffic to a InfluxDB database
  influxdb:
    # to enable, set the enable to true
    enable: false
    # InfluxDB server url
    server-url: "http://localhost:8086"
    # authentication token
    auth-token: ""
    # enable tls
    tls-support: false
    # insecure skip verify
    tls-insecure: false
    # bucket
    bucket: "db_dns"
    # Organization
    organization: "dnscollector"

  # resend captured dns traffic to a Loki Server
  lokiclient:
    # to enable, set the enable to true
    enable: false
    # Loki server url
    server-url: "http://lokiwriter.home.lab/loki/api/v1/push"
    # Job name
    job-name: "dnscollector"
    # output format: text|json
    mode: text
    # flush batch every X seconds
    flush-interval: 5
    # batch size for log entries in bytes
    batch-size: 1048576
    # interval in second between before to retry to send log entries
    retry-interval: 10
    # output text format, please refer to the default text format to see all available directives 
    # use this parameter if you want a specific format
    text-format: "localtime identity qr queryip family protocol qname qtype rcode"
    # Proxy URL
    proxy-url: ""
    # insecure skip verify
    tls-insecure: false
    # basic auth login
    basic-auth-login: ""
    # basic auth password
    basic-auth-pwd: ""
    # tenant/organisation id. If omitted or empty, no X-Scope-OrgID header is sent.
    tenant-id: "" 

  # forward to statsd proxy
  statsd:
    # to enable, set the enable to true
    enable: false
    # network transport to use: udp|tcp
    transport: udp
    # remote address
    remote-address: 127.0.0.1
    # remote tcp port
    remote-port: 8125
    # enable tls
    tls-support: false
    # insecure skip verify
    tls-insecure: false
    # prefix
    prefix: "dnscollector"
    # flush every X seconds
    flush-interval: 10